rcf-lite 0.26.0 → 0.28.0

package/blueprints/observability-probe-endpoints/contributions/requirements/observability-probe-endpoints-req-007.json

@@ -3,6 +3,10 @@
   "prdId": "PRD-001",
   "title": "The probe paths are auth-exempt scoped exactly to the resolved probe path set on the resolved listener",
   "description": "For every HTTP-transport profile, the probe path set the profile resolved (e.g., `/live` and `/ready` for Kubernetes default) is exempt from the project's auth middleware on the listener the profile bound those handlers to. The exemption is scoped by exact path match and by listener, never by prefix. When the fused topology is in effect, the exemption applies on the user-traffic listener for those exact paths only; when the separate-port topology is in effect, the exemption applies on the separate probe listener for those exact paths only and no auth middleware runs on the separate listener because no other route is served there. A path near a probe path but not on the resolved set (e.g., `/ready/next` when `/ready` is the probe) receives the project's normal auth treatment.",
+  "deliveredBy": {
+    "tacId": "TAC-1503-observability-probe-endpoints-listener-topology",
+    "field": "interfaces.exemptListInstaller"
+  },
   "category": "security",
   "domain": "observability",
   "priority": "must",

package/blueprints/observability-probe-endpoints/contributions/requirements/observability-probe-endpoints-req-008.json

@@ -3,6 +3,10 @@
   "prdId": "PRD-001",
   "title": "A change of target integration profile is a configuration change; the source tree does not re-shape",
   "description": "Switching the target integration from one profile to another (for example, moving a service from a Kubernetes deployment to a Docker Compose deployment behind a load balancer) is expressed as a change to the operator-declared profile name and its per-profile options. The source tree that binds the profile handlers and the profile-resolver call site do not change; the profile shift takes effect on the next process start. A source-tree change is required only when the operator authors a new custom profile or extends the shipped profile set; existing profiles are switched by configuration alone.",
+  "deliveredBy": {
+    "tacId": "TAC-1501-observability-probe-endpoints-profile-resolver",
+    "field": "interfaces.contractValidator"
+  },
   "category": "nonFunctional",
   "domain": "observability",
   "priority": "must",

package/blueprints/observability-probe-endpoints/contributions/user-stories/observability-probe-endpoints-us-14101.json

@@ -11,21 +11,27 @@
   "acceptanceCriteria": [
     {
       "id": "AC-14101-1",
-      "description": "A process configured with `probeInterface.profile: kubernetes` boots and binds probe handlers whose paths and port topology match the resolved Kubernetes profile.",
+      "description": "A process configured with `probeInterface.profile: kubernetes` boots and binds probe handlers whose paths and port topology match the resolved Kubernetes profile. Template values the applying agent sets: The applying agent sets the elicited target-integration-profile (or its equivalent target-integration elicit); the AC substitutes the project's profile name for the illustrative Kubernetes / loadBalancer / reverseProxy / systemd tokens.",
       "given": "a process configuration whose profile declaration resolves to `kubernetes` with default paths and fused-listener topology",
       "when": "the process boots and its probe-binding step completes",
       "then": "the running listener answers GET on the profile-declared liveness path (default /live) with 200 and on the profile-declared readiness path (default /ready) with 200 or 503, and no probe handler is bound at any path outside the profile-declared set",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-14101-2",
-      "description": "A process configured without a `probeInterface.profile` declaration and no shipped default refuses to boot with a stable-coded error naming the missing declaration.",
-      "given": "a process configuration whose profile declaration is absent and whose environment has removed the shipped default",
-      "when": "the process boots and its profile-resolution step runs",
-      "then": "the process exits with a non-zero code and emits a `PROBE_PROFILE_MISSING` error naming the declaration field the operator must set",
+      "description": "A process configured without a `probeInterface.profile` declaration falls back to the shipped Kubernetes default per ADR-1503 and boots normally on the kubernetes profile handlers.",
+      "given": "a process with no `probeInterface.profile` declaration on the applied configuration and the shipped Kubernetes default present",
+      "when": "the process boots",
+      "then": "the process boots without error, the resolved profile is `kubernetes`, and the running listener answers GET on `/live` and `/ready` with 200",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "adrId": "ADR-1503-observability-probe-endpoints-kubernetes-default",
+        "field": "decision.kubernetesDefault"
+      }
     },
     {
       "id": "AC-14101-3",
@@ -34,7 +40,22 @@
       "when": "the process boots and its profile-resolution step runs",
       "then": "the process exits with a non-zero code and emits a `PROBE_PROFILE_UNKNOWN` error whose message contains the offending value and the enumerated valid profile names",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-14101-4",
+      "description": "A process configured with a `probeInterface` declaration that is syntactically malformed (not an object, or an object missing the required per-profile keys) refuses to boot with the stable-coded PROBE_PROFILE_MALFORMED error naming the offending shape.",
+      "given": "a process with `probeInterface` set to a non-object value (a bare string, an array), OR to an object that names a valid profile but omits per-profile required keys",
+      "when": "the process boots",
+      "then": "the process exits with a non-zero code and emits a `PROBE_PROFILE_MALFORMED` error whose message names the offending shape (the type it received and the required keys it expected); no listener binds",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1501-observability-probe-endpoints-profile-resolver",
+        "field": "interfaces.contractValidator"
+      }
     }
   ],
   "tacIds": [
@@ -42,5 +63,5 @@
     "TAC-1502-observability-probe-endpoints-handler-set"
   ],
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/observability-probe-endpoints/contributions/user-stories/observability-probe-endpoints-us-14102.json

@@ -16,7 +16,8 @@
       "when": "an unauthenticated GET is issued against `/live` on the request-traffic listener port",
       "then": "the response status code is 200 and the JSON body equals `{\"status\":\"pass\"}`",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-14102-2",
@@ -25,7 +26,8 @@
       "when": "a GET is issued against `/live`",
       "then": "the observer records zero egress connections attributable to the handler between request receipt and response send",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-14102-3",
@@ -34,16 +36,32 @@
       "when": "the stubbed state is set to pass and a GET is issued against `/ready`, then the stubbed state is set to fail and a GET is issued again",
       "then": "the first response has status 200 and body `{\"status\":\"pass\"}`; the second response has status 503 and body `{\"status\":\"fail\"}`",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-14102-4",
-      "description": "When the operator sets probeInterface.options.kubernetes.startup.enabled: true on the shipped Kubernetes profile, the resolver returns a three-path set including the startup path (default /startup) and the handler-set builder generates a startup handler that answers pass once the operator-declared startup predicate returns pass and fail otherwise.",
+      "description": "When the operator sets probeInterface.options.kubernetes.startup.enabled: true on the shipped Kubernetes profile, the resolver returns a three-path set including the startup path (default /startup) and the handler-set builder generates a startup handler that answers pass once the operator-declared startup predicate returns pass and fail otherwise. Template values the applying agent sets: The applying agent sets the elicited target-integration-profile (or its equivalent target-integration elicit); the AC substitutes the project's profile name for the illustrative Kubernetes / loadBalancer / reverseProxy / systemd tokens.",
       "given": "a process on the shipped kubernetes profile with probeInterface.options.kubernetes.startup.enabled set to true, a startup predicate wired against a stubbed initialisation state, and the paths option left at its default",
       "when": "the resolver runs at boot, and then GETs are issued against /startup with the stubbed state first fail then pass",
       "then": "the resolver returns { profile: kubernetes, paths: [/live, /ready, /startup] }; the first GET on /startup returns 503 with body {\"status\":\"fail\"}; the second GET on /startup returns 200 with body {\"status\":\"pass\"}; without the enable flag the resolver returns two paths and no /startup handler is registered",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
+    },
+    {
+      "id": "AC-14102-5",
+      "description": "A Kubernetes-profile liveness handler on a process whose in-process liveness self-check predicate returns fail answers HTTP 503 with an empty body, so a kubelet restart is triggered on the next probe interval; the predicate is response-capable by design (a watchdog-style tick that runs on a scheduled interval and sets a boolean the handler reads without I/O). Template values the applying agent sets: The applying agent supplies the liveness self-check predicate the AC observes (the scheduled heartbeat and its budget); the AC exercises the failure branch of that predicate rather than proving the predicate itself.",
+      "given": "a process on the shipped Kubernetes default with a project-owned liveness self-check predicate (a scheduled 1-second heartbeat that has not fired within its 5-second budget flips the predicate to fail) and no dependency coupling on this handler",
+      "when": "kubelet issues HTTP GET /live while the predicate is in the fail state",
+      "then": "the response is HTTP 503 with content-length 0 and an empty body; a follow-up GET while the predicate is still fail continues to answer 503; a GET after the predicate returns to pass answers 200",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-1502-observability-probe-endpoints-handler-set",
+        "field": "interfaces.readinessPredicate"
+      }
     }
   ],
   "tacIds": [
@@ -51,5 +69,5 @@
     "TAC-1503-observability-probe-endpoints-listener-topology"
   ],
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-09-04T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/observability-probe-endpoints/contributions/user-stories/observability-probe-endpoints-us-14103.json

@@ -16,7 +16,8 @@
       "when": "the profile resolver runs at boot",
       "then": "the resolved profile object has non-null `transport`, non-empty `paths` or its transport-appropriate equivalent, non-null `responseContract`, and non-null `semanticModel`",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-14103-2",
@@ -25,7 +26,8 @@
       "when": "the profile resolver runs at boot",
       "then": "the process exits with a non-zero code and emits a `PROBE_PROFILE_INCOMPLETE` error naming the missing field and the profile name",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-14103-3",
@@ -34,7 +36,8 @@
       "when": "the profile resolver runs and the handler set binds",
       "then": "exactly one HTTP GET handler is bound at the profile's resolved path (default `/health`), no handler is bound at `/live` or `/ready`, and the resolved profile's `semanticModel` equals `singleHealthSignal`",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [

package/blueprints/observability-probe-endpoints/contributions/user-stories/observability-probe-endpoints-us-14104.json

@@ -11,30 +11,33 @@
   "acceptanceCriteria": [
     {
       "id": "AC-14104-1",
-      "description": "When `probeListener.separatePort: <N>` is set on the Kubernetes profile, probe handlers bind to port N and no probe handler is bound on the user-traffic listener.",
+      "description": "When `probeListener.separatePort: <N>` is set on the Kubernetes profile, probe handlers bind to port N and no probe handler is bound on the user-traffic listener. Template values the applying agent sets: The applying agent sets the elicited target-integration-profile (or its equivalent target-integration elicit); the AC substitutes the project's profile name for the illustrative Kubernetes / loadBalancer / reverseProxy / systemd tokens.",
       "given": "a process configured with `probeInterface.profile: kubernetes` and `probeListener.separatePort: 9091` with a distinct user-traffic port",
       "when": "the process boots and the topology binds",
       "then": "a GET against `/live` on port 9091 returns 200, a GET against `/live` on the user-traffic port returns 404 (or the project's default not-found response), and a GET against `/ready` on the user-traffic port returns 404",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-14104-2",
-      "description": "The separate probe listener binds only the profile's resolved probe path set; any other path returns not-found on the probe listener.",
+      "description": "The separate probe listener binds only the profile's resolved probe path set; any other path returns not-found on the probe listener. Template values the applying agent sets: The applying agent sets the elicited target-integration-profile (or its equivalent target-integration elicit); the AC substitutes the project's profile name for the illustrative Kubernetes / loadBalancer / reverseProxy / systemd tokens.",
       "given": "a process on the Kubernetes profile with `probeListener.separatePort: 9091` and a user-authored `/api/orders` route on the traffic listener",
       "when": "a GET against `/api/orders` is issued against port 9091",
       "then": "the response status is 404 (or the profile's declared not-found), and the request is not routed to the `/api/orders` handler",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-14104-3",
-      "description": "The default topology remains fused (probes bind on the user-traffic listener) when `probeListener.separatePort` is unset.",
+      "description": "The default topology remains fused (probes bind on the user-traffic listener) when `probeListener.separatePort` is unset. Template values the applying agent sets: The applying agent sets the elicited target-integration-profile (or its equivalent target-integration elicit); the AC substitutes the project's profile name for the illustrative Kubernetes / loadBalancer / reverseProxy / systemd tokens.",
       "given": "a process on the Kubernetes profile with no `probeListener.separatePort` override",
       "when": "the process boots and the topology binds",
       "then": "GET `/live` on the user-traffic listener returns 200 and no additional listener is opened",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     }
   ],
   "tacIds": [

package/blueprints/observability-probe-endpoints/contributions/user-stories/observability-probe-endpoints-us-14105.json

@@ -16,7 +16,8 @@
       "when": "an HTTP GET is issued against the resolved health path in each state",
       "then": "the pass response has status 200 with content-length 0 and no body; the fail response has status 503 with content-length 0 and no body",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-14105-2",
@@ -25,7 +26,8 @@
       "when": "an HTTP GET is issued against `/live` and `/ready` in each state and the parsed JSON body key set is inspected",
       "then": "the parsed body is exactly a one-key object whose only key is `status` and whose value is `pass` or `fail` matching the resolved answer",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-14105-3",
@@ -34,7 +36,50 @@
       "when": "the profile's healthcheck command entry point is invoked in each state",
       "then": "the pass invocation exits with code 0; the fail invocation exits with a non-zero code; the process opens no HTTP probe listener when this profile is selected",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-14105-4",
+      "description": "A systemd-profile process under Type=notify emits sd_notify(READY=1) exactly once after boot completes and sd_notify(WATCHDOG=1) at the configured watchdog cadence for the process lifetime; a process that fails to send WATCHDOG within the cadence budget is signalled fail by the systemd supervisor. Template values the applying agent sets: The applying agent supplies the elicited probe-interface-profile value (systemd or a TCP-transport profile), the systemd watchdog cadence, and the TCP probe port; the AC substitutes those for the illustrative values.",
+      "given": "a process configured with probe-interface-profile=systemd, watchdog cadence 10 seconds, and a project-owned readiness predicate returning pass",
+      "when": "the process boots and runs for 30 seconds under a mock systemd notify sink",
+      "then": "the sink records exactly one READY=1 line after boot and at least two WATCHDOG=1 lines within the 30-second window; if the process is paused past the watchdog budget, the sink records no further WATCHDOG=1 lines and the supervisor pull is signalled",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-1504-observability-probe-endpoints-non-http-adapters",
+        "field": "interfaces.notifyImplementation"
+      }
+    },
+    {
+      "id": "AC-14105-5",
+      "description": "A TCP-transport probe profile answers a TCP socket connect on the configured probe port with an accept on pass and a refuse (RST) on fail; the response is the accept/refuse itself and no bytes are exchanged on the connection. Template values the applying agent sets: The applying agent supplies the elicited probe-interface-profile value (systemd or a TCP-transport profile), the systemd watchdog cadence, and the TCP probe port; the AC substitutes those for the illustrative values.",
+      "given": "a process configured with a TCP-transport profile (a custom profile or a supervising system that reads TCP accept/refuse), probe port 9091, and a readiness predicate returning pass then fail",
+      "when": "a supervisor issues one TCP connect while pass, then one TCP connect after the predicate flips to fail",
+      "then": "the pass connect completes the three-way handshake and reads zero bytes on the connection before close; the fail connect is refused (RST or connection refused) within the connect timeout; no application-layer data crosses the connection in either case",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-1504-observability-probe-endpoints-non-http-adapters",
+        "field": "interfaces.selectAdapter"
+      }
+    },
+    {
+      "id": "AC-14105-6",
+      "description": "A process configured with a target-integration profile whose platform adapter is missing (the project has not supplied the systemd notify sink for the systemd profile, or the TCP listener factory for a TCP-transport profile) refuses to boot with the stable-coded PROBE_ADAPTER_MISSING error naming the missing adapter and the profile that requires it.",
+      "given": "a process configured with a systemd profile but without an sd_notify implementation supplied on TAC-1504 selectAdapter",
+      "when": "the process boots",
+      "then": "the process exits with a non-zero code and emits PROBE_ADAPTER_MISSING naming the profile (systemd) and the missing adapter (notify implementation); no listener binds",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1504-observability-probe-endpoints-non-http-adapters",
+        "field": "interfaces.selectAdapter"
+      }
     }
   ],
   "tacIds": [
@@ -42,5 +87,5 @@
     "TAC-1504-observability-probe-endpoints-non-http-adapters"
   ],
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/observability-probe-endpoints/contributions/user-stories/observability-probe-endpoints-us-14106.json

@@ -11,30 +11,33 @@
   "acceptanceCriteria": [
     {
       "id": "AC-14106-1",
-      "description": "The Kubernetes profile's `/live` and `/ready` responses contain no substring matching a declared dependency name, environment name, hostname, replica identifier, build hash, or commit sha.",
+      "description": "The Kubernetes profile's `/live` and `/ready` responses contain no substring matching a declared dependency name, environment name, hostname, replica identifier, build hash, or commit sha. Template values the applying agent sets: The applying agent sets the elicited target-integration-profile (or its equivalent target-integration elicit); the AC substitutes the project's profile name for the illustrative Kubernetes / loadBalancer / reverseProxy / systemd tokens.",
       "given": "a process on the Kubernetes profile with declared dependencies `paymentsProvider` and `primaryStore`, environment `live`, hostname `svc-abc-123`, build hash `deadbeef`, commit sha `abcd1234abcd1234abcd1234abcd12341234abcd`",
       "when": "an HTTP GET is issued against `/live` and against `/ready` and each response body is scanned for the tokens above",
       "then": "no scan finds any of the tokens on either response body",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-14106-2",
-      "description": "The profile validator refuses a profile override that adds a field beyond the enumerated response contract at boot.",
+      "description": "The profile validator refuses a profile override that adds a field beyond the enumerated response contract at boot. Template values the applying agent sets: The applying agent sets the elicited target-integration-profile (or its equivalent target-integration elicit); the AC substitutes the project's profile name for the illustrative Kubernetes / loadBalancer / reverseProxy / systemd tokens.",
       "given": "a profile configuration that adds a `dependencies` array to the Kubernetes profile's response body",
       "when": "the profile validator runs at boot",
       "then": "the process exits with a non-zero code and emits a `PROBE_RESPONSE_FIELD_REFUSED` error naming the offending field and the profile name",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-14106-3",
       "description": "The load-balancer and reverse-proxy profile responses contain content-length zero on every request.",
       "given": "a process on the `loadBalancer` profile and a second process on the `reverseProxy` profile, both booted normally",
       "when": "HTTP GET requests are issued against the resolved health path on each process for both pass and fail states",
-      "then": "every response carries `Content-Length: 0` and the response body is empty",
+      "then": "every response carries the `content-length` header with value 0 and the response body is empty",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [

package/blueprints/observability-probe-endpoints/contributions/user-stories/observability-probe-endpoints-us-14107.json

@@ -11,39 +11,43 @@
   "acceptanceCriteria": [
     {
       "id": "AC-14107-1",
-      "description": "On the Kubernetes profile with fused topology and an auth middleware that rejects unauthenticated requests, GET on the resolved `/live` and `/ready` paths returns the probe status; GET on any other user-traffic route returns the middleware's unauthenticated response.",
+      "description": "On the Kubernetes profile with fused topology and an auth middleware that rejects unauthenticated requests, GET on the resolved `/live` and `/ready` paths returns the probe status; GET on any other user-traffic route returns the middleware's unauthenticated response. Template values the applying agent sets: The applying agent sets the elicited target-integration-profile (or its equivalent target-integration elicit); the AC substitutes the project's profile name for the illustrative Kubernetes / loadBalancer / reverseProxy / systemd tokens.",
       "given": "a process on the Kubernetes profile with fused topology, a project auth middleware installed on the user-traffic listener that returns 401 on unauthenticated requests, and a user-authored `/api/orders` route on that listener",
       "when": "unauthenticated GET requests are issued to `/live`, `/ready`, `/api/orders`, and `/ready/next`",
       "then": "`/live` and `/ready` return 200 or 503 per the probe answer; `/api/orders` returns 401; `/ready/next` returns the route's normal handler-or-not-found response after the middleware runs (a match on `/ready/next` is not treated as an exempt path)",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-14107-2",
-      "description": "On the Kubernetes profile with separate-port topology, the separate probe listener does not install the project auth middleware and answers probes without an auth challenge; the user-traffic listener answers `/live` and `/ready` under normal auth rules.",
+      "description": "On the Kubernetes profile with separate-port topology, the separate probe listener does not install the project auth middleware and answers probes without an auth challenge; the user-traffic listener answers `/live` and `/ready` under normal auth rules. Template values the applying agent sets: The applying agent sets the elicited target-integration-profile (or its equivalent target-integration elicit); the AC substitutes the project's profile name for the illustrative Kubernetes / loadBalancer / reverseProxy / systemd tokens.",
       "given": "a process on the Kubernetes profile with `probeListener.separatePort: 9091` and a project auth middleware installed on the user-traffic listener",
       "when": "unauthenticated GET requests are issued to `/live` and `/ready` on both port 9091 and on the user-traffic port",
       "then": "the port-9091 requests return the probe status; the user-traffic-port requests return the auth middleware's unauthenticated response",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-14107-3",
-      "description": "The exemption list produced by the profile at boot enumerates exactly the resolved probe path set, scoped by exact-match rules, and is refused if any entry contains a wildcard or prefix syntax.",
+      "description": "The exemption list produced by the profile at boot enumerates exactly the resolved probe path set, scoped by exact-match rules, and is refused if any entry contains a wildcard or prefix syntax. Template values the applying agent sets: The applying agent sets the elicited target-integration-profile (or its equivalent target-integration elicit); the AC substitutes the project's profile name for the illustrative Kubernetes / loadBalancer / reverseProxy / systemd tokens.",
       "given": "the exemption list produced by the profile resolver on the Kubernetes profile default",
       "when": "the exemption-list emitter runs and the produced entries are inspected",
       "then": "the list contains exactly the strings `/live` and `/ready` and their exact-match matcher rule; any injected entry containing `*` or a trailing slash to imply a prefix causes the emitter to refuse with a stable-coded error",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-14107-4",
-      "description": "When the optional startup path is enabled on the Kubernetes profile, the exemption list produced by the profile at boot enumerates exactly three exact-match entries /live, /ready and /startup on the resolved listener; a wildcard or prefix entry (a trailing slash implying prefix, an entry containing *) causes the emitter to refuse with the same stable-coded error as AC-14107-3.",
+      "description": "When the optional startup path is enabled on the Kubernetes profile, the exemption list produced by the profile at boot enumerates exactly three exact-match entries /live, /ready and /startup on the resolved listener; a wildcard or prefix entry (a trailing slash implying prefix, an entry containing *) causes the emitter to refuse with the same stable-coded error as AC-14107-3. Template values the applying agent sets: The applying agent sets the elicited target-integration-profile (or its equivalent target-integration elicit); the AC substitutes the project's profile name for the illustrative Kubernetes / loadBalancer / reverseProxy / systemd tokens.",
       "given": "the exemption list produced by the profile resolver on the Kubernetes profile with probeInterface.options.kubernetes.startup.enabled set to true",
       "when": "the exemption-list emitter runs and the produced entries are inspected, and separately an injected entry containing */ or * is presented",
       "then": "the list contains exactly the three strings /live, /ready and /startup and their exact-match matcher rule; any wildcard-shaped entry is refused with a stable-coded error",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     }
   ],
   "tacIds": [

package/blueprints/observability-probe-endpoints/contributions/user-stories/observability-probe-endpoints-us-14108.json

@@ -16,7 +16,8 @@
       "when": "the process restarts on the new configuration and the topology binds",
       "then": "a GET against `/health` returns 200 or 503; no probe handler is bound at `/live` or `/ready`; a source-tree diff between the two boots contains no non-configuration changes",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-14108-2",
@@ -25,7 +26,8 @@
       "when": "the operator sets `probeInterface.profile: custom:tcpOnly` in configuration and the process restarts",
       "then": "the resolver loads the custom profile, the topology binds the profile's declared surface, and no additional source-tree change is required to move between the shipped set and the custom profile",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-14108-3",
@@ -34,7 +36,8 @@
       "when": "a scan searches for `probeInterface.profile` usage and per-profile branching (e.g., `if (profile === 'kubernetes')`) outside the `profiles/` directory and the profile-resolver module",
       "then": "the scan finds exactly one usage of `probeInterface.profile` (the resolver invocation) and zero per-profile conditionals in the rest of the boot path",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [

package/blueprints/observability-probe-endpoints/docs/topics.md

@@ -19,7 +19,7 @@ Rules for new topics (inherited from the application-spa, application-api-rest,
 
 ## Id number bands (registry bootstrap)
 
-AC ids (and therefore US numeric ids, which anchor them) are NOT namespaced by the 0.5.0 schema grammar; the band allocation IS the AC-collision enforcement mechanism. Composing blueprints take a fresh band rather than proposing namespaced AC ids. Band allocation is ratified policy (2026-08-19); this table is the shared registry-bootstrap replicated across every shipped and forthcoming blueprint's `docs/topics.md` until a mechanism-side central registry lands (v1.1 candidate).
+AC ids (and therefore US numeric ids, which anchor them) are NOT namespaced by the 0.5.0 schema grammar; the band allocation IS the AC-collision enforcement mechanism. Composing blueprints take a fresh band rather than proposing namespaced AC ids. Band allocation is policy; this table is the shared registry-bootstrap replicated across every shipped and forthcoming blueprint's `docs/topics.md` until a mechanism-side central registry lands (v1.1 candidate).
 
 This table is maintained shelf-wide across every blueprint's `docs/topics.md`. Rows are recorded at ship, never predicted.
 
@@ -64,7 +64,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | platform-docker-compose-host | 38101-38899 | 39xx | shipped v1.0.0 | `containerHostContract` |
 | edge-cloudflare-tunnel | 39101-39899 | 40xx | shipped v1.0.0 | `edgeIngressBridge` |
 
-US 14101-14108 sit at the LOW end of the 14101-14899 band on purpose. A project-side story that mechanically derives from an observability-probe-endpoints REQ id into the number `14108` would collide against observability-probe-endpoints-US-14108 in this package; the band leaves headroom at the HIGH end (US 14181-14899) so a project's own stories anchored to observability-probe-endpoints REQs can allocate without conflict. The watchpost run4 lesson applies here too. Band spacing between the previous HQ-lane row (persistence-data-d1, 13101-13899, 14xx) and this one (14101-14899, 15xx) reflects the four-digit widening pattern opened by security-auth-clerk at 10xx and continued through the round-2 HQ lane.
+US 14101-14108 sit at the LOW end of the 14101-14899 band on purpose. A project-side story that mechanically derives from an observability-probe-endpoints REQ id into the number `14108` would collide against observability-probe-endpoints-US-14108 in this package; the band leaves headroom at the HIGH end (US 14181-14899) so a project's own stories anchored to observability-probe-endpoints REQs can allocate without conflict. Band spacing between the previous shelf-lane row (persistence-data-d1, 13101-13899, 14xx) and this one (14101-14899, 15xx) reflects the four-digit widening pattern opened by security-auth-clerk at 10xx and continued through the second shelf-lane block.
 
 ## Shared expectations for future composing blueprints
 

package/blueprints/observability-probe-endpoints/guide/observability-probe-endpoints.md

@@ -4,7 +4,7 @@
 
 A default probe-surface blueprint for rcf-lite projects that must integrate with an EXTERNAL supervising system whose conventions drive the probe wire shape. The blueprint contributes the WHAT of a probe pattern: how the operator declares which external supervisor the service runs under (`kubernetes`, `loadBalancer`, `uptimeMonitor`, `systemd`, `dockerHealthcheck`, `reverseProxy`, or a project-authored `custom:<name>`), how each profile fixes the probe transport, path or command surface, response contract, and semantic distinction between liveness and readiness for that supervisor, how a fused-listener default coexists with a `probeListener.separatePort` opt-in for probe-traffic isolation, how the auth-exempt list stays scoped to the resolved probe path set exactly, and how switching supervising systems is a configuration change rather than a source-tree reshape.
 
-Concretely, the blueprint ships eight requirements, eight user stories (twenty-four acceptance criteria), four architecture components, and five architecture decision records. Two ADRs are `scope: global` on the topics `healthProbes` (the profile-elicited probe interface) and `readinessSemantics` (per-profile readiness aggregation); the other three are scope-local (Kubernetes default profile, separate-port option, external-response secrecy rule). The two global ADRs conflict with the observability-essentials sibling by design; see 'Boundary with observability-essentials' below.
+Concretely, the blueprint ships eight requirements, eight user stories (twenty-four acceptance criteria), four architecture components, and five architecture decision records. Two ADRs are `scope: global` on the topics `healthProbes` (the profile-elicited probe interface) and `readinessSemantics` (per-profile readiness aggregation); the other three are scope-local (Kubernetes default profile, separate-port option, external-response secrecy rule). From essentials v2.0.0 onward this blueprint is the sole `scope: global` claimant on both topics; see 'Boundary with observability-essentials' below for the current alignment and the pre-v2 migration note.
 
 ## What it is not
 
@@ -26,12 +26,9 @@ observability-essentials and observability-probe-endpoints are BOTH `observabili
 
 - **observability-probe-endpoints** targets the external-integration case: the service runs under a specific external supervising system (a Kubernetes kubelet, an application load balancer, an uptime monitor, a systemd unit, a Docker HEALTHCHECK invocation, a reverse-proxy upstream health check), and the wire shape of the probes follows that supervisor's conventions. The audience of the probe response IS the external supervisor; the response is minimal by construction so the surface never carries reconnaissance value to unintended readers. The identity is 'make your service correctly probeable by whatever external system supervises it'.
 
-Composing the two on one project fires two `globalAdrTopic` conflicts (on `healthProbes` and on `readinessSemantics`) on purpose. The four documented resolution paths per topic apply: adopt the incoming blueprint (remove the existing), keep the existing (do not add the incoming), author a project-level ADR that supersedes both, or declare the resolution on the add itself with `--resolve`. The right resolution is usually one of two shapes:
+From v2.0.0 of observability-essentials the two blueprints compose cleanly on the current shelf. Essentials v2 dropped its `scope: global` claims on the `healthProbes` and `readinessSemantics` topics and defers probe-path binding to this blueprint; probe-endpoints is now the sole `scope: global` claimant on both topics, so applying either order (essentials then probe-endpoints, or probe-endpoints then essentials) resolves to exactly one global ADR per topic with no `globalAdrTopic` conflict fired. The essentials blueprint continues to own `statusPageContract` and the notification-outcome sink; probe-endpoints continues to own the probe surface. The compose test at `packages/rcf-lite/test/blueprint/probe-path-alignment.test.js` is the ratified truth for this alignment.
 
-- **Shape A (external supervisor wins):** the project runs under a supervisor whose conventions drive the wire shape; a project-level ADR fixes both topics against the probe-endpoints model and observability-essentials contributes the public status page and notification outcome sink through the compose while keeping its `statusPageContract` topic untouched.
-- **Shape B (self-supervised wins):** the project designs its own observability floor without a specific external supervisor's conventions in view; a project-level ADR fixes both topics against the essentials model and this blueprint is not applied.
-
-Explicit hybrids exist (an internal essentials-shaped surface for one audience and a profile-shaped external surface for the supervising system) and are legitimate; the project-level ADR names both surfaces with explicit boundaries and both blueprints compose.
+Historical migration note (pre-v2 essentials): earlier essentials releases (v1.x, superseded by v2.0.0) claimed `scope: global` on `healthProbes` and `readinessSemantics`. A project that still applies pre-v2 essentials alongside this blueprint fires the two conflicts and resolves them at project level with a project-level ADR (adopt one shape, keep the existing, author a project-level ADR that supersedes both, or declare the resolution on the add itself with `--resolve`). Migrating to essentials v2 removes the resolution burden.
 
 Composing with the `deploy-cloudflare-workers` blueprint is a separate concern: that blueprint mandates its own build-provenance probe (`/healthz` by convention) whose response body carries `{ versionSha, builtAt, ciRunUrl }` for the deploy verifier's reconciliation, which is incompatible with every profile's minimal response contract; the two surfaces coexist on distinct paths (this blueprint's profile-owned path stays minimal, the deploy blueprint's provenance path lives on a separate string), and the boundary is documented on the deploy side in `assets/verification/served-surface-probes.md`.
 

package/blueprints/persistence-data-d1/CHANGELOG.md

@@ -0,0 +1,32 @@
+# Changelog
+
+## 1.1.6 - 2026-09-11
+
+facade-round-trip AC-13101-4 (missing-binding refusal) row is de-claimed to conformanceOnly (anchorAcId=null on the row; the module anchor is unchanged). The refusal is thrown by the local fixture's openFacade before any call reaches the D1 engine, so no engine-returned request id or resource identifier is available; the credential-leak-absent predicate is retained on the row. The earlier CHANGELOG description of a locally minted callTrackingId as a resource identifier is corrected: the field is dropped from the probe's evidence and the language does not appear here.
+
+## 1.1.5 - 2026-09-11
+
+AC-13101-4 anchor now positively asserts no-credential-leak: a sentinel account id and API token are stashed on the env passed to openFacade alongside the missing DB binding, and the row verdict requires neither sentinel appears in the refusal error message, kind, bindingName, stack or JSON serialisation (credentialLeakAbsent=true); the row records a locally minted row correlation string on the row (no engine identifier is available on the refusal path). CHANGELOG history restored (the 1.1.0/1.1.1/1.1.2 entries were unintentionally overwritten in the previous pass) and this 1.1.5 entry is added.
+
+## 1.1.4 - 2026-09-11
+
+Adds a contributions/probes/ pack (facade-round-trip, migrations-forward-only, real-account-d1-round-trip) with a fixture-side sqlite-backed D1 binding and a facade module under packages/rcf-lite/test/fixtures/probe-pack-persistence-data-d1/. Probes run against the fixture on Node 24 and against real Cloudflare D1 on the account-bound branch (CI_HAS_CLOUDFLARE_ACCOUNT gate + CF_ACCOUNT_ID + CF_API_TOKEN, one variable per skip row).
+
+Anchoring: facade-round-trip anchors AC-13101-4 (missing-binding refusal) as its module anchor; the facadeReady, insert, find and delete rows de-claim (conformanceOnly, anchorAcId=null) with limitations naming AC-13101-1 or AC-13101-2 (source-tree sole-reader and facade-surface scan are not observable at runtime). migrations-forward-only anchors AC-13102-2 as its module anchor; each row de-claims with a limitation naming AC-13102-2 or AC-13102-3 (wrangler CLI not spawned; internal table name is not the configured d1_migrations). real-account-d1-round-trip anchors AC-13101-1 as its module anchor; every live row de-claims with the limitation naming AC-13101-1 (raw REST is not the source-tree sole-reader property). Live create rows record only what the create call proves; presentAfterDelete is set only on the teardown row after delete + inventory. An auth failure with credentials PRESENT is a FAIL, not an accountBoundSkipped row. Live scratch resources are named qa-e-d1-<short> and deleted with a post-run inventory check.
+
+## 1.1.2 - 2026-09-10
+
+Removed the `prepare().bind()` and `db.exec(<consumer string>)` literals from `ADR-1404.context` (the argument now names the prepared-statement discipline owned on `TAC-1401-persistence-data-d1-facade.responsibilities[2]`); added the one-line owner pointer to the facade-shape asset and the batch-usage asset naming the TAC responsibility indices they demonstrate. ADR-1404 bumped to 1.0.1.
+
+## 1.1.1 - 2026-09-10
+
+Dimension-d single-definition-ownership cleanup on REQ-004: REQ description now references the prepared-statement discipline owned on TAC-1401 (facade responsibilities) rather than restating the vendor prepare/bind/exec literals. `deliveredBy` re-pointed at `TAC-1401-persistence-data-d1-facade.responsibilities.prepare` so the pass-2 delivery-carried check resolves against surface text present on the TAC. Chain-consistency lint zero on pass 1 and pass 2.
+
+## 1.1.0 - 2026-09-09
+Adds deliveredBy on REQ-001. Adds ownerRef and disposition to every AC. ADR-1404 settles the allowed query surface: `db.exec` is refused on the facade's public verbs and on consumer code, and permitted only inside the migration runner, out of consumer reach. No new contributions.
+
+
+
+Version bumped from 1.0.1 to 1.1.0 to reflect the net-added AC contributions on existing stories (migration-D1-binding failure paths added under US-13101; deploy-gate quota-exhausted added under US-13102).
+
+Adds deliveredBy on REQ-002 through REQ-007 (six of seven mandatory REQs). Sweeps vendorCitation onto fixed ACs resting on vendor facts (AC-13103-1, AC-13104-3, AC-13105-2).

package/blueprints/persistence-data-d1/README.md

@@ -27,9 +27,9 @@ The doc set is contributions (copied into the project tree by `rcf define bluepr
 
 ## What it contributes, and what it deliberately does not
 
-Contributed kinds: REQ, US (with inline ACs), TAC, ADR. Adherence is expressed as ACs; the blueprint ships no test files (ratified decision 5) and no code.
+Contributed kinds: REQ, US (with inline ACs), TAC, ADR. Adherence is expressed as ACs; the blueprint ships no test files (shipped policy 5) and no code.
 
-No FBS contributions, as a matter of principle (ratified policy 2026-08-19): FBSs are the work of the implementing agent, not the blueprint; project constraints have to be applied at the time of creation. The blueprint contributes the WHAT (the store facade contract, the wrangler-owned migration discipline, the deploy-pipeline gate contract, the prepared-statement and batch atomicity boundaries, the two-path recovery model, the metadata-only event log discipline); the implementing agent derives the HOW-tasks (FBS) in the host project, where the ACs contributed here get picked up by the project's own build sequencing.
+No FBS contributions, as a matter of principle (policy): FBSs are the work of the implementing agent, not the blueprint; project constraints have to be applied at the time of creation. The blueprint contributes the WHAT (the store facade contract, the wrangler-owned migration discipline, the deploy-pipeline gate contract, the prepared-statement and batch atomicity boundaries, the two-path recovery model, the metadata-only event log discipline); the implementing agent derives the HOW-tasks (FBS) in the host project, where the ACs contributed here get picked up by the project's own build sequencing.
 
 Deliberately not contributed: the domain schema (the tables the project's own entities live in are project-authored, on top of the migration directory the project maintains; the blueprint governs the facade contract and the migration discipline, not the domain shape); an ORM or query builder above the D1 prepared-statement surface (the facade is a project-authored surface; how it internally implements its verbs above the vendor binding is not blueprint-owned, but the boundary discipline refuses raw-SQL passthrough on the public surface); a Worker deploy blueprint (a companion `deploy-cloudflare-workers` blueprint is the natural pair for the Worker deploy step the deploy-gate TAC assumes; until it ships, projects wire their own deploy step); a secrets management surface for the CI credential that runs `wrangler d1 migrations apply` and `wrangler deploy` (the credential storage and rotation posture are the concern of the `security-secrets-management` blueprint, not this one); a CI pipeline template (CI shape is the concern of the `delivery-ci-workflows` blueprint, not this one; this blueprint contributes the requirement that the migrations-apply step orders strictly before the deploy step, not the file that implements it); a replication or failover surface (D1's read-replica surface is a read-scaling primitive, not a failover primitive; a project needing failover supersedes ADR-1401 with an alternate engine); a logical schema-agnostic dump beyond the vendor's `wrangler d1 export` (out of scope; see ADR-1405's alternatives).
 
@@ -43,7 +43,7 @@ See `docs/topics.md` for the exact strings, the expected resolutions, the deline
 
 ## Quality bar
 
-Single D1 database bound into the Worker under one named binding read by exactly one facade module; every read and write through the facade issued as `db.prepare(<static SQL literal>).bind(...)` with no consumer-supplied SQL and no `db.exec(<consumer string>)` on any path; multi-statement writes requiring atomicity through `db.batch([...])` with no partial-batch results surfaced; numbered forward-only `.sql` migration files under the wrangler-configured directory with the vendor CLI as the sole applier and the vendor bookkeeping table as the sole applied-state ledger; deploy pipeline that orders `wrangler d1 migrations apply` strictly before `wrangler deploy` per environment and refuses the deploy on any apply failure; two-path recovery (Time Travel point-in-time restore within the plan window and a scheduled `wrangler d1 export` to a portable off-vendor artifact) exercisable from the ops or CI surface without a Worker code change; structured event log at five defined moments (facadeReady, migrationsApplied, backupExported, timeTravelRestored, queryFailed) with metadata-only fields carrying no domain-row values. Every bar is carried by ACs in the doc set, not by this README.
+Single D1 database bound into the Worker under one named binding read by exactly one facade module; every read and write through the facade follows the prepared-statement chain owned on TAC-1401-persistence-data-d1-facade.responsibilities[2] (parameterised statement literals, no consumer-supplied SQL and no raw `exec` on any path); multi-statement writes requiring atomicity go through the batch call owned on TAC-1401-persistence-data-d1-facade.responsibilities[3] with no partial-batch results surfaced; numbered forward-only `.sql` migration files under the wrangler-configured directory with the vendor CLI as the sole applier and the vendor bookkeeping table as the sole applied-state ledger; deploy pipeline that orders `wrangler d1 migrations apply` strictly before `wrangler deploy` per environment and refuses the deploy on any apply failure; two-path recovery (Time Travel point-in-time restore within the plan window and a scheduled `wrangler d1 export` to a portable off-vendor artifact) exercisable from the ops or CI surface without a Worker code change; structured event log at five defined moments (facadeReady, migrationsApplied, backupExported, timeTravelRestored, queryFailed) with metadata-only fields carrying no domain-row values. Every bar is carried by ACs in the doc set, not by this README.
 
 ## Known mechanism-reach gaps
 

package/blueprints/persistence-data-d1/assets/batch-usage/batch-atomicity-example.md

@@ -1,5 +1,7 @@
 # Batch atomicity in the D1 facade
 
+> Owner: the batch atomicity primitive the facade uses for multi-statement writes is defined on `TAC-1401-persistence-data-d1-facade.responsibilities[3]` (batch call); the surrounding prepared-statement discipline is defined on `TAC-1401-persistence-data-d1-facade.responsibilities[2]`. This asset demonstrates usage; the definitions live on the TAC.
+
 D1 does not expose explicit BEGIN / COMMIT to the Worker binding. `db.batch([...])` is the vendor's atomicity primitive for multi-statement writes: the vendor's contract states that a mid-batch failure aborts and rolls back the entire sequence. This asset shows the shape a facade verb takes when its domain contract requires two or more statements to land as one unit (AC-13105-1, AC-13105-2).
 
 ## Verb shape

package/blueprints/persistence-data-d1/assets/facade-shape/facade-module-shape.md

@@ -1,5 +1,7 @@
 # D1 store facade module shape
 
+> Owner: the prepared-statement chain the facade issues every read and write through is defined on `TAC-1401-persistence-data-d1-facade.responsibilities[2]`. This asset demonstrates usage; the definition lives on the TAC.
+
 The facade (TAC-1401) is one module that reads the D1 binding from the Worker `env`, exposes named domain verbs, issues every statement as a parameterised prepared statement, uses `db.batch([...])` for multi-statement atomicity, and emits structured lifecycle events on the injected sink. This asset shows the exact shape with a worked domain example.
 
 ## Module layout