rcf-lite 0.27.0 → 0.28.0

package/blueprints/application-file-upload/contributions/probes/chunked-transport-endpoints.mjs

@@ -0,0 +1,173 @@
+// chunked-transport-endpoints probe for application-file-upload v1.2.7.
+//
+// Row 1 (AC-23104-1): multipart transport - one declared file is
+// sent as four sequential equal-sized 4 KiB chunk POSTs against
+// one sessionId; the server's per-session byte accounting advances
+// by the actual body bytes of each chunk and the completion GET
+// reports chunksUploaded higher than one and complete=true.
+// Row 2 (AC-23104-3): tus transport - Upload-Offset writes bytes
+// durably; a mismatched offset returns 409 WITHOUT advancing the
+// stored offset; the probe then re-reads the state and issues a
+// RESUME PATCH from the last acknowledged offset, closing the
+// gap (post-409 state check + resume PATCH from the AC).
+//
+// anchorAcId: per-row.
+
+import { startFixture, evidenceFromResponse, conformanceOnlyResult, notObservableHereResult } from './probe-utils.mjs';
+import { randomUUID } from 'node:crypto';
+
+export const anchorReqId = 'application-file-upload-REQ-004';
+export const accountBound = false;
+
+export default async function runProbe() {
+ const { startServer } = await import('../../../../packages/rcf-lite/test/fixtures/probe-pack-application-file-upload/server.js');
+ const fixture = await startFixture({ startServer, port: 0 });
+ try {
+ const results = [];
+
+ // Row 1 (AC-23104-1 server-observable half): ONE file forced into
+ // multiple chunks on the ?transport=multipart branch. AC-23104-1
+ // requires a file large enough to force chunking with a completed
+ // chunk count higher than 1. The probe declares one file of
+ // sixteen KiB and posts four sequential 4 KiB chunks against the
+ // same sessionId; the fixture's per-session byte accounting
+ // advances by the actual body bytes of each chunk and the final
+ // response reports the file as complete. AC-23104-1 has three
+ // halves: multipart chunk-count in the DOM (browser), tus PATCH
+ // with Upload-Offset on the browser network log (browser), and
+ // the underlying server-side byte accounting for one file forced
+ // into multiple chunks (server-observable). The probe positively
+ // observes the third half and records the row as conformanceOnly
+ // with a limitation naming the two browser halves not observed
+ // here.
+ const sessionId = `session-${randomUUID()}`;
+ const oneFileBytes = 16 * 1024;
+ const chunkBytes = 4 * 1024;
+ const chunkCount = oneFileBytes / chunkBytes;
+ const files = [{ name: 'one-large-file.bin', bytes: oneFileBytes }];
+ await fetch(`${fixture.baseUrl}/upload/session?sessionId=${sessionId}`, {
+ method: 'POST', headers: { 'content-type': 'application/json' },
+ body: JSON.stringify({ totalExpectedBytes: oneFileBytes, files }),
+ });
+ const chunkResults = [];
+ let lastChunkRes, lastChunkBody = '';
+ for (let i = 0; i < chunkCount; i += 1) {
+ const payload = Buffer.alloc(chunkBytes, 65 + i);
+ const r = await fetch(`${fixture.baseUrl}/upload/chunk?n=${i + 1}&sessionId=${sessionId}`, { method: 'POST', body: payload });
+ const b = await r.text();
+ const parsed = JSON.parse(b);
+ chunkResults.push({ chunk: i + 1, bytesReceived: parsed.bytesReceived, uploadedBytes: parsed.uploadedBytes, chunksUploaded: parsed.chunksUploaded, complete: parsed.complete });
+ lastChunkRes = r; lastChunkBody = b;
+ }
+ const finalRes = await fetch(`${fixture.baseUrl}/upload/chunk?sessionId=${sessionId}`);
+ const finalBody = await finalRes.text();
+ const finalParsed = JSON.parse(finalBody);
+ const allChunksAcceptedFor4KiB = chunkResults.every((c) => c.bytesReceived === chunkBytes);
+ const chunksHigherThanOne = finalParsed.chunksUploaded > 1;
+ const bytesAdvanced = finalParsed.uploadedBytes === oneFileBytes;
+ const completeAtEnd = finalParsed.complete === true;
+ const chunkOk = allChunksAcceptedFor4KiB && chunksHigherThanOne && bytesAdvanced && completeAtEnd;
+ results.push(conformanceOnlyResult({
+ anchorAcId: 'application-file-upload-AC-23104-1',
+ verdict: chunkOk ? 'pass' : 'fail',
+ detail: `On the ?transport=multipart branch the fixture returns 200 - one file (${oneFileBytes} B) forced into ${chunkCount} chunks of ${chunkBytes} B; chunksUploaded=${finalParsed.chunksUploaded} (>1: ${chunksHigherThanOne}); uploadedBytes=${finalParsed.uploadedBytes}/${oneFileBytes} (complete=${completeAtEnd})`,
+ evidence: evidenceFromResponse({
+ route: `/upload/chunk (sessionId=${sessionId})`,
+ response: lastChunkRes,
+ bodyText: lastChunkBody,
+ extraFields: {
+ input: { sessionId, files, totalExpectedBytes: oneFileBytes, chunkBytes, chunkCount },
+ derived: { chunkResults, finalParsed, allChunksAcceptedFor4KiB, chunksHigherThanOne, bytesAdvanced, completeAtEnd },
+ },
+ }),
+ limitation: 'application-file-upload-AC-23104-1: [data-transport] and [data-chunks-uploaded] DOM values, and the browser-network PATCH log carrying Upload-Offset on the tus branch, are not observable on a server-driven probe pack; this row observes the server-side byte accounting of one file forced into multiple chunks only',
+ }));
+ results.push(notObservableHereResult({
+ ac: 'application-file-upload-AC-23104-1',
+ detail: 'On the ?transport=multipart branch the fixture returns 200 - the DOM half ([data-transport], [data-chunks-uploaded]) is browser-only',
+ reason: 'AC-23104-1 requires observing [data-transport="multipart"] and [data-chunks-uploaded] on the rendered DOM; a server-side probe pack cannot observe DOM',
+ evidence: { requires: 'browser DOM observation', ac: 'application-file-upload-AC-23104-1', half: 'dom' },
+ }));
+ results.push(notObservableHereResult({
+ ac: 'application-file-upload-AC-23104-1',
+ detail: 'On the ?transport=multipart branch the fixture returns 200 - the tus network half (PATCH with Upload-Offset on the browser network log) is browser-only',
+ reason: 'AC-23104-1 requires observing at least one PATCH on the browser network log whose request headers include a numeric Upload-Offset; a server-side probe pack cannot observe the browser network log',
+ evidence: { requires: 'browser network log observation', ac: 'application-file-upload-AC-23104-1', half: 'browser-network' },
+ }));
+
+ // Row 2 (AC-23104-3): tus offset write; a 409 mismatch does not
+ // advance stored offset; the resume PATCH from the last
+ // acknowledged offset succeeds.
+ const uploadId = `upload-${randomUUID()}`;
+ const patch1 = await fetch(`${fixture.baseUrl}/upload/tus?uploadId=${uploadId}`, {
+ method: 'PATCH', headers: { 'upload-offset': '0' }, body: Buffer.alloc(4096, 65),
+ });
+ const patch1Offset = patch1.headers.get('upload-offset');
+ const get1 = await fetch(`${fixture.baseUrl}/upload/tus?uploadId=${uploadId}`);
+ const get1Body = await get1.text();
+ const get1Parsed = JSON.parse(get1Body);
+ const patch2 = await fetch(`${fixture.baseUrl}/upload/tus?uploadId=${uploadId}`, {
+ method: 'PATCH', headers: { 'upload-offset': '4096' }, body: Buffer.alloc(8192, 66),
+ });
+ const patch2Offset = patch2.headers.get('upload-offset');
+ const get2 = await fetch(`${fixture.baseUrl}/upload/tus?uploadId=${uploadId}`);
+ const get2Body = await get2.text();
+ const get2Parsed = JSON.parse(get2Body);
+ // Bad PATCH: declared offset 99999 while stored is 12288.
+ const patchBad = await fetch(`${fixture.baseUrl}/upload/tus?uploadId=${uploadId}`, {
+ method: 'PATCH', headers: { 'upload-offset': '99999' }, body: Buffer.alloc(10, 67),
+ });
+ const patchBadBody = await patchBad.text();
+ // AC-23104-3 post-failure state check: stored offset must NOT
+ // have moved, and the client re-reads Upload-Offset before
+ // resuming (post-409 state check plus resume PATCH).
+ const postFail = await fetch(`${fixture.baseUrl}/upload/tus?uploadId=${uploadId}`);
+ const postFailBody = await postFail.text();
+ const postFailParsed = JSON.parse(postFailBody);
+ const storedUnchanged = postFailParsed.storedBytes === 12288;
+ // Resume PATCH from the last acknowledged offset (12288) with a
+ // real payload; on success the stored bytes advance again.
+ const resumeBytes = 1024;
+ const patchResume = await fetch(`${fixture.baseUrl}/upload/tus?uploadId=${uploadId}`, {
+ method: 'PATCH', headers: { 'upload-offset': String(postFailParsed.storedBytes) }, body: Buffer.alloc(resumeBytes, 68),
+ });
+ const patchResumeOffset = patchResume.headers.get('upload-offset');
+ const getResume = await fetch(`${fixture.baseUrl}/upload/tus?uploadId=${uploadId}`);
+ const getResumeBody = await getResume.text();
+ const getResumeParsed = JSON.parse(getResumeBody);
+ const resumeOk = patchResume.status === 204
+ && patchResumeOffset === String(12288 + resumeBytes)
+ && getResumeParsed.storedBytes === 12288 + resumeBytes;
+ const tusOk = patch1.status === 204 && patch1Offset === '4096' && get1Parsed.storedBytes === 4096
+ && patch2.status === 204 && patch2Offset === '12288' && get2Parsed.storedBytes === 12288
+ && patchBad.status === 409 && storedUnchanged
+ && resumeOk;
+ results.push({
+ anchorAcId: 'application-file-upload-AC-23104-3',
+ verdict: tusOk ? 'pass' : 'fail',
+ detail: `Upload-Offset on the tus branch matches the byte - tus writes byte-derived: PATCH#1 stored=${get1Parsed.storedBytes}, PATCH#2 stored=${get2Parsed.storedBytes}, mismatch PATCH -> ${patchBad.status} (stored unchanged=${storedUnchanged}), resume PATCH -> ${patchResume.status} stored=${getResumeParsed.storedBytes}`,
+ evidence: evidenceFromResponse({
+ route: `/upload/tus (uploadId=${uploadId})`,
+ response: getResume,
+ bodyText: getResumeBody,
+ extraFields: {
+ input: { uploadId, patches: [
+ { offset: 0, bytes: 4096 },
+ { offset: 4096, bytes: 8192 },
+ { offset: 99999, bytes: 10, expectMismatch: true },
+ { offset: 12288, bytes: resumeBytes, resume: true },
+ ] },
+ derived: {
+ patch1Offset, patch2Offset, stored1: get1Parsed.storedBytes, stored2: get2Parsed.storedBytes,
+ mismatchStatus: patchBad.status, storedUnchanged, postFailBody: postFailBody.slice(0, 240),
+ resumeStatus: patchResume.status, resumeStoredBytes: getResumeParsed.storedBytes, resumeOffsetHeader: patchResumeOffset,
+ },
+ },
+ }),
+ });
+
+ return { results };
+ } finally {
+ await fixture.close();
+ }
+}

package/blueprints/application-file-upload/contributions/probes/per-file-progressbar.mjs

@@ -0,0 +1,124 @@
+// per-file-progressbar probe for application-file-upload v1.2.7.
+//
+// Row 1 (AC-23102-1, browser-only): rendered live-region text and
+// per-file DOM values are notObservableHere.
+// Row 2 (AC-23102-2, byte-weighted aggregate discrimination):
+// three files of 1 MiB, 2 MiB and 5 MiB upload one at a time. The
+// probe records the fixture's uploadedBytes / totalExpectedBytes
+// after EACH file completes and compares the byte-weighted aggregate
+// against the plain average of per-file percents at the same point.
+// Discrimination is unambiguous after files 1 and 2 (byte-weighted
+// 12.5% vs plain-average 33.3% after file 1; 37.5% vs 66.7% after
+// file 2); after file 3 both collapse to 100% (the AC's aggregate
+// meets its terminal condition). Row is conformanceOnly with a
+// limitation naming that only the server-side aggregate byte
+// accounting is asserted here; the AC's rendered aggregate value
+// on the polite live region is a browser-observable half.
+// Row 3 (AC-23102-2, browser-only half): the emitted announcement
+// text on the polite live region is a browser DOM observation and
+// is recorded as notObservableHere against the same AC so the
+// browser half is represented on the shelf alongside the server
+// counting evidence.
+//
+// anchorAcId: per-row.
+
+import { startFixture, evidenceFromResponse, notObservableHereResult, conformanceOnlyResult } from './probe-utils.mjs';
+import { randomUUID } from 'node:crypto';
+
+export const anchorReqId = 'application-file-upload-REQ-002';
+export const accountBound = false;
+
+const MIB = 1024 * 1024;
+
+export default async function runProbe() {
+ const { startServer } = await import('../../../../packages/rcf-lite/test/fixtures/probe-pack-application-file-upload/server.js');
+ const fixture = await startFixture({ startServer, port: 0 });
+ try {
+ const results = [];
+
+ // Row 1: notObservableHere for the live-region + per-file DOM value.
+ results.push(notObservableHereResult({
+ ac: 'application-file-upload-AC-23102-1',
+ detail: 'The upload region ships a [data-live-region="polite"] wrapper with - rendered live-region text and per-file DOM values are browser-only',
+ reason: 'AC-23102-1 requires observing the rendered aria-live text and the per-file DOM progressbar value change; a server-side probe pack cannot observe DOM mutation',
+ evidence: { requires: 'browser DOM observation', ac: 'application-file-upload-AC-23102-1' },
+ }));
+
+ const sessionId = `session-${randomUUID()}`;
+ const files = [
+ { name: 'a.bin', bytes: 1 * MIB },
+ { name: 'b.bin', bytes: 2 * MIB },
+ { name: 'c.bin', bytes: 5 * MIB },
+ ];
+ const totalExpectedBytes = files.reduce((s, f) => s + f.bytes, 0);
+ await fetch(`${fixture.baseUrl}/upload/session?sessionId=${sessionId}`, {
+ method: 'POST',
+ headers: { 'content-type': 'application/json' },
+ body: JSON.stringify({ totalExpectedBytes, files }),
+ });
+
+ const perStep = [];
+ let lastRes, lastBody = '';
+ const fileBytesPerFile = files.map((f) => 0);
+ for (const [i, f] of files.entries()) {
+ const payload = Buffer.alloc(f.bytes, 65 + i);
+ const chunkRes = await fetch(`${fixture.baseUrl}/upload/chunk?n=${i + 1}&sessionId=${sessionId}`, {
+ method: 'POST', body: payload,
+ });
+ const chunkBody = await chunkRes.text();
+ const parsed = JSON.parse(chunkBody);
+ fileBytesPerFile[i] = parsed.bytesReceived;
+ // Byte-weighted percent = server's uploadedBytes / totalExpectedBytes.
+ const byteWeightedPercent = (parsed.uploadedBytes / totalExpectedBytes) * 100;
+ // Plain average of per-file percents at this same point.
+ const perFilePercents = files.map((ff, idx) => (fileBytesPerFile[idx] / ff.bytes) * 100);
+ const plainAveragePercent = perFilePercents.reduce((a, b) => a + b, 0) / perFilePercents.length;
+ perStep.push({
+ afterFileIndex: i,
+ uploadedBytes: parsed.uploadedBytes,
+ byteWeightedPercent: Number(byteWeightedPercent.toFixed(2)),
+ perFilePercents: perFilePercents.map((p) => Number(p.toFixed(2))),
+ plainAveragePercent: Number(plainAveragePercent.toFixed(2)),
+ discriminates: Math.abs(byteWeightedPercent - plainAveragePercent) > 0.5,
+ });
+ lastRes = chunkRes; lastBody = chunkBody;
+ }
+ // Discrimination proven if the intermediate steps distinguish byte-weighted
+ // from plain-average by more than 0.5 percentage points.
+ const intermediateDiscriminates = perStep[0].discriminates && perStep[1].discriminates;
+ const finalConverges = Math.abs(perStep[2].byteWeightedPercent - 100) < 0.5;
+ const runOk = intermediateDiscriminates && finalConverges;
+ results.push(conformanceOnlyResult({
+ anchorAcId: 'application-file-upload-AC-23102-2',
+ verdict: runOk ? 'pass' : 'fail',
+ detail: `Aggregate progress is the byte-weighted sum of per-file - after file 1 byteWeighted=${perStep[0].byteWeightedPercent}% vs plainAverage=${perStep[0].plainAveragePercent}%; after file 2 ${perStep[1].byteWeightedPercent}% vs ${perStep[1].plainAveragePercent}%; after file 3 ${perStep[2].byteWeightedPercent}% vs ${perStep[2].plainAveragePercent}% (converge at completion)`,
+ evidence: evidenceFromResponse({
+ route: `/upload/chunk (sessionId=${sessionId})`,
+ response: lastRes,
+ bodyText: lastBody,
+ extraFields: {
+ input: { sessionId, filesDeclared: files, totalExpectedBytes },
+ derived: { perStep, intermediateDiscriminates, finalConverges },
+ },
+ }),
+ limitation: 'application-file-upload-AC-23102-2: the polite live region\'s rendered aggregate announcement text is not observable on a server-driven probe pack; the byte-weighted aggregate is asserted from the server\'s uploaded-bytes accounting only',
+ }));
+
+ // Row 3: notObservableHere for AC-23102-2's browser-observable
+ // half - the emitted aggregate announcement text on the polite
+ // live region. The AC's `when` and `then` explicitly concern the
+ // announcer's emitted value in the DOM, which a server-driven
+ // probe pack cannot observe; the row represents that half on the
+ // shelf so it is not carried by the server row's limitation alone.
+ results.push(notObservableHereResult({
+ ac: 'application-file-upload-AC-23102-2',
+ detail: 'Aggregate progress is the byte-weighted sum of per-file - the announcer\'s emitted aggregate text on the polite live region is a browser DOM observation',
+ reason: 'AC-23102-2 requires observing the aggregate progress text emitted through the polite live region; a server-side probe pack cannot observe DOM mutation or aria-live announcements',
+ evidence: { requires: 'browser DOM observation of the polite live region', ac: 'application-file-upload-AC-23102-2' },
+ }));
+
+ return { results };
+ } finally {
+ await fixture.close();
+ }
+}

package/blueprints/application-file-upload/contributions/probes/probe-utils.mjs

@@ -0,0 +1,177 @@
+// Shared helpers for application-file-upload probes.
+//
+// The engine under probe is the sample-app fixture at
+// packages/rcf-lite/test/fixtures/probe-pack-application-file-upload/server.js. The
+// fixture stamps an x-fixture-request-id header on every response as
+// part of its own request pipeline (no probe-side monkey-patch), so
+// the identifier the probe records is the identifier the engine
+// itself issued. Probes call the fixture over real HTTP via node's
+// fetch, vary inputs, assert derived outputs, and record the
+// request-id, status, body excerpt, the varied input and the derived
+// output as evidence on every result row.
+// No account-bound branch: the engine is a local fixture, not a
+// third-party account, so no CI_HAS_* gate is invented. Every env
+// var this pack reads is declared on the fixture README.
+
+import { mkdir, writeFile } from 'node:fs/promises';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+export const PROJECT_ROOT = resolve(HERE, '..', '..', '..', '..');
+export const FIXTURE_DIR = resolve(PROJECT_ROOT, 'packages/rcf-lite/test/fixtures/probe-pack-application-file-upload');
+export const REPORT_DIR = resolve(PROJECT_ROOT, '.rcf/reports/blueprints/application-file-upload');
+
+export const DEFAULT_PORT = 0;
+
+export function aggregate(results) {
+  if (!Array.isArray(results) || results.length === 0) return 'fail';
+  if (results.some((r) => r.verdict === 'fail')) return 'fail';
+  if (results.some((r) => r.verdict === 'warn')) return 'warn';
+  return 'pass';
+}
+
+// Empty results never pass: a synthesised row is emitted with an actionable detail and its
+// own evidence object recording the empty condition so the row is
+// not a naked verdict scalar.
+export function normaliseResults(results) {
+  if (!Array.isArray(results) || results.length === 0) {
+    return [{
+      anchorReqId: 'unknown',
+      verdict: 'fail',
+      detail: 'no checks ran',
+      evidence: {
+        reason: 'empty-results',
+        route: 'n/a',
+        status: 0,
+        xFixtureRequestId: null,
+        bodyExcerpt: '',
+      },
+    }];
+  }
+  return results;
+}
+
+export async function writeReport({ probeName, engine, results, extra }) {
+  await mkdir(REPORT_DIR, { recursive: true });
+  const report = {
+    slug: 'application-file-upload',
+    probeName,
+    runAt: new Date().toISOString(),
+    engine,
+    results,
+    aggregateVerdict: aggregate(results),
+    ...(extra ?? {}),
+  };
+  const path = resolve(REPORT_DIR, `${probeName}.json`);
+  await writeFile(path, JSON.stringify(report, null, 2) + '\n', 'utf8');
+  return { report, path };
+}
+
+// Starts the fixture on an ephemeral port (or PROBE_PORT when set)
+// and returns { server, port, baseUrl, close }. The close helper
+// rejects when the underlying close callback carries an error;
+// swallowing a teardown error would hide a boundary failure.
+export async function startFixture({ startServer, port } = {}) {
+  const resolvedPort = typeof port === 'number'
+    ? port
+    : Number(process.env.PROBE_PORT ?? DEFAULT_PORT);
+  const started = await startServer({ port: resolvedPort });
+  return {
+    server: started.server,
+    port: started.port,
+    baseUrl: `http://127.0.0.1:${started.port}`,
+    close: () => new Promise((res, rej) => started.server.close((err) => {
+      if (err) rej(err);
+      else res();
+    })),
+  };
+}
+
+// Reads a distinctive slice of a response body: the first N chars
+// so the report carries a body excerpt alongside the header id.
+export function bodyExcerpt(text, max = 240) {
+  if (text == null) return '';
+  const s = typeof text === 'string' ? text : String(text);
+  return s.length > max ? s.slice(0, max) + '...' : s;
+}
+
+// Records the positive-evidence shape on a probe result. Every row
+// carries route, status, the request id the fixture stamped, and a
+// body excerpt; the caller may extend the object with the varied
+// input and the derived output for that row.
+export function evidenceFromResponse({ route, response, bodyText, extraFields }) {
+  return {
+    route,
+    status: response.status,
+    xFixtureRequestId: response.headers.get('x-fixture-request-id') || null,
+    bodyExcerpt: bodyExcerpt(bodyText),
+    ...(extraFields ?? {}),
+  };
+}
+
+export async function runShim(probeName, engine, mainFn) {
+  try {
+    const outcome = (await mainFn()) ?? { results: [] };
+    const { results, extra } = outcome;
+    const { report, path } = await writeReport({ probeName, engine, results: normaliseResults(results), extra });
+    process.stdout.write(JSON.stringify(report, null, 2) + '\n');
+    process.stdout.write(`report written to ${path}\n`);
+    if (report.aggregateVerdict !== 'pass') process.exitCode = 1;
+  } catch (err) {
+    const results = [{
+      anchorReqId: 'unknown',
+      verdict: 'fail',
+      detail: `probe threw: ${err && err.message ? err.message : String(err)}`,
+      evidence: {
+        reason: 'probe-threw',
+        route: 'n/a',
+        status: 0,
+        xFixtureRequestId: null,
+        bodyExcerpt: err && err.stack ? String(err.stack).slice(0, 240) : '',
+      },
+    }];
+    const { report, path } = await writeReport({ probeName, engine, results });
+    process.stdout.write(JSON.stringify(report, null, 2) + '\n');
+    process.stderr.write(`probe error: ${err && err.stack ? err.stack : String(err)}\n`);
+    process.stderr.write(`report written to ${path}\n`);
+    process.exitCode = 1;
+  }
+}
+
+// Browser-observable properties are AMBER on the shelf by ruling.
+// A row that names such a property is recorded as notObservableHere
+// carrying an object with the AC id and a reason; the tally script
+// reads notObservableHere.ac to accept the row.
+export function notObservableHereResult({ ac, anchorAcId, detail, reason, evidence } = {}) {
+  // A notObservableHere row anchors nothing else: no anchorAcId,
+  // no anchorReqId - only notObservableHere.ac.
+  const acId = ac || anchorAcId;
+  return {
+    verdict: 'pass',
+    notObservableHere: {
+      ac: acId,
+      reason: reason || 'not observable on server-side probe pack; needs a browser-driven runner',
+    },
+    detail: detail || 'not observable on server-side probe pack',
+    evidence: {
+      reason: reason || 'not observable here; needs a browser-driven probe runner',
+      ...(evidence || {}),
+    },
+  };
+}
+
+// A row that keeps a real observation but records that the
+// observation only covers part of an AC uses conformanceOnly +
+// limitation carrying the AC id and the property not observed.
+export function conformanceOnlyResult({ anchorAcId, anchorReqId, verdict, detail, evidence, limitation }) {
+  return {
+    ...(anchorAcId ? { anchorAcId } : {}),
+    ...(anchorReqId ? { anchorReqId } : {}),
+    verdict: verdict || 'pass',
+    conformanceOnly: true,
+    limitation: limitation || 'browser-observable property not asserted from the server-side probe',
+    detail,
+    evidence,
+  };
+}

package/blueprints/application-file-upload/contributions/probes/run-assertive-completion-slot.mjs

@@ -0,0 +1,4 @@
+import runProbe from './assertive-completion-slot.mjs';
+import { runShim } from './probe-utils.mjs';
+const engine = { kind: 'application-file-upload-fixture', server: 'packages/rcf-lite/test/fixtures/probe-pack-application-file-upload/server.js' };
+runShim('assertive-completion-slot', engine, runProbe);

package/blueprints/application-file-upload/contributions/probes/run-chunked-transport-endpoints.mjs

@@ -0,0 +1,4 @@
+import runProbe from './chunked-transport-endpoints.mjs';
+import { runShim } from './probe-utils.mjs';
+const engine = { kind: 'application-file-upload-fixture', server: 'packages/rcf-lite/test/fixtures/probe-pack-application-file-upload/server.js' };
+runShim('chunked-transport-endpoints', engine, runProbe);

package/blueprints/application-file-upload/contributions/probes/run-per-file-progressbar.mjs

@@ -0,0 +1,4 @@
+import runProbe from './per-file-progressbar.mjs';
+import { runShim } from './probe-utils.mjs';
+const engine = { kind: 'application-file-upload-fixture', server: 'packages/rcf-lite/test/fixtures/probe-pack-application-file-upload/server.js' };
+runShim('per-file-progressbar', engine, runProbe);

package/blueprints/application-file-upload/contributions/probes/run-upload-surface-shape.mjs

@@ -0,0 +1,4 @@
+import runProbe from './upload-surface-shape.mjs';
+import { runShim } from './probe-utils.mjs';
+const engine = { kind: 'application-file-upload-fixture', server: 'packages/rcf-lite/test/fixtures/probe-pack-application-file-upload/server.js' };
+runShim('upload-surface-shape', engine, runProbe);

package/blueprints/application-file-upload/contributions/probes/upload-surface-shape.mjs

@@ -0,0 +1,55 @@
+// upload-surface-shape probe for application-file-upload v1.2.7.
+//
+// AC-23101-1: the upload region carries [data-surface="file-upload"]
+// plus a labelled input, drop-zone and open-picker button. The
+// browser-observable half (Enter-press and focus movement) is
+// covered by the conformanceOnly limitation on the single row - no
+// duplicate notObservableHere row (a same-AC positive row alongside a
+// notObservable row would duplicate the anchor).
+//
+// anchorAcId: application-file-upload-AC-23101-1.
+
+import { startFixture, evidenceFromResponse, conformanceOnlyResult } from './probe-utils.mjs';
+
+export const anchorReqId = 'application-file-upload-REQ-001';
+export const accountBound = false;
+
+export default async function runProbe() {
+ const { startServer } = await import('../../../../packages/rcf-lite/test/fixtures/probe-pack-application-file-upload/server.js');
+ const fixture = await startFixture({ startServer, port: 0 });
+ try {
+ const results = [];
+ const res = await fetch(`${fixture.baseUrl}/upload`);
+ const body = await res.text();
+ const surface = /data-surface="file-upload"/.test(body);
+ const label = /<label[^>]+for="filePicker"/.test(body);
+ const input = /<input[^>]+id="filePicker"[^>]+type="file"[^>]+multiple/.test(body);
+ const dropZoneMatch = body.match(/<div[^>]+data-drop-zone[^>]+aria-label="([^"]+)"[^>]*>/);
+ const pickerMatch = body.match(/<button[^>]+data-open-picker[^>]+aria-label="([^"]+)"[^>]*>/);
+ const pass = res.status === 200 && surface && label && input && !!dropZoneMatch && !!pickerMatch;
+ results.push(conformanceOnlyResult({
+ anchorAcId: 'application-file-upload-AC-23101-1',
+ anchorReqId: 'application-file-upload-REQ-001',
+ verdict: pass ? 'pass' : 'fail',
+ detail: `The upload region carries [data-surface="file-upload"] and inside it: - server-observable half: labelled input, drop-zone (aria-label="${dropZoneMatch?.[1] ?? 'null'}") and open-picker button (aria-label="${pickerMatch?.[1] ?? 'null'}")`,
+ evidence: evidenceFromResponse({
+ route: '/upload',
+ response: res,
+ bodyText: body,
+ extraFields: {
+ input: { path: '/upload' },
+ derived: {
+ surface, label, input,
+ dropZoneAriaLabel: dropZoneMatch?.[1] ?? null,
+ pickerAriaLabel: pickerMatch?.[1] ?? null,
+ },
+ },
+ }),
+ limitation: 'application-file-upload-AC-23101-1: Enter-press on the button and focus return are browser-only',
+ }));
+
+ return { results };
+ } finally {
+ await fixture.close();
+ }
+}

package/blueprints/application-file-upload/contributions/requirements/application-file-upload-req-001.json

@@ -10,7 +10,7 @@
   "category": "functional",
   "domain": "application",
   "priority": "must",
-  "rationale": "Per visual round 4 spec section 5.2, REQ 1.",
+  "rationale": "Per the application-core specification section 5.2, REQ 1.",
   "tags": [
     "blueprint:application-file-upload",
     "category:01-input-contract"

package/blueprints/application-file-upload/contributions/requirements/application-file-upload-req-002.json

@@ -10,7 +10,7 @@
   "category": "functional",
   "domain": "application",
   "priority": "must",
-  "rationale": "Per visual round 4 spec section 5.2, REQ 2.",
+  "rationale": "Per the application-core specification section 5.2, REQ 2.",
   "tags": [
     "blueprint:application-file-upload",
     "category:02-progress-contract"

package/blueprints/application-file-upload/contributions/requirements/application-file-upload-req-003.json

@@ -10,7 +10,7 @@
   "category": "functional",
   "domain": "application",
   "priority": "must",
-  "rationale": "Per visual round 4 spec section 5.2, REQ 3.",
+  "rationale": "Per the application-core specification section 5.2, REQ 3.",
   "tags": [
     "blueprint:application-file-upload",
     "category:03-refusal-contract"

package/blueprints/application-file-upload/contributions/requirements/application-file-upload-req-004.json

@@ -10,7 +10,7 @@
   "category": "functional",
   "domain": "application",
   "priority": "must",
-  "rationale": "Per visual round 4 spec section 5.2, REQ 4.",
+  "rationale": "Per the application-core specification section 5.2, REQ 4.",
   "tags": [
     "blueprint:application-file-upload",
     "category:04-transport-contract"

package/blueprints/application-file-upload/contributions/requirements/application-file-upload-req-005.json

@@ -10,7 +10,7 @@
   "category": "functional",
   "domain": "application",
   "priority": "must",
-  "rationale": "Per visual round 4 spec section 5.2, REQ 5.",
+  "rationale": "Per the application-core specification section 5.2, REQ 5.",
   "tags": [
     "blueprint:application-file-upload",
     "category:05-completion-contract"

package/blueprints/application-file-upload/probe-packs/application-file-upload.pack.mjs

@@ -9,7 +9,7 @@
 //
 // Every check drives the real Playwright browser the runner
 // injects. URLs are composed by the withUrl(runtimeUrl, path) helper
-// per the round 3 fix train; no bare string concatenation.
+// that joins runtime URL and path safely; no bare string concatenation.
 //
 // Sample-app fixture:
 // packages/rcf-lite/test/fixtures/probe-pack-application-file-upload/