rcf-lite 0.27.0 → 0.28.0

package/blueprints/object-storage-s3/contributions/probes/presigned-url.mjs

@@ -1,24 +1,52 @@
 /**
  * Presigned URL probe.
  *
- * Issues a presigned URL with TTL 60 seconds, fetches it with Node
- * built-in fetch, asserts 200 within TTL. Sleeps to TTL+2 seconds,
- * fetches again, asserts 403 or the storage-side 403-equivalent.
+ * Per AC-28103-1 the property is: with a bounded TTL, a fetch WITHIN
+ * TTL returns 200, and the SAME URL fetched after TTL+2 seconds
+ * returns 403 (S3-shape AccessDenied). This probe proves the property
+ * exactly: it presigns a URL at the ADR-2902 floor of 60s, fetches it
+ * within TTL and records 200 + body-equal, then sleeps TTL+2s and
+ * fetches the SAME URL again and records 403.
  *
- * Anchors AC-28103-1.
+ * The floor-refusal below the 60s floor is also asserted (a separate
+ * result row) per ADR-2902.
  */
 
-import { createObjectStore, endpointFromEnv, credentialsFromShim } from '../../../../packages/rcf-lite/test/fixtures/infra-s3-and-queue/src/object-store.mjs';
+import { createObjectStore, endpointFromEnv, credentialsFromShim, MissingS3EndpointError } from '../../../../packages/rcf-lite/test/fixtures/infra-s3-and-queue/src/object-store.mjs';
 import { secretsShim } from '../../../../packages/rcf-lite/test/fixtures/infra-s3-and-queue/src/secrets.mjs';
 import { probeKey } from './probe-utils.mjs';
+import { createHash } from 'node:crypto';
+
+export const DECLARED_ENV = Object.freeze(['S3_ENDPOINT_URL']);
 
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+const AC28103_1 = 'Given a presignGetUrl call with ttl=60 seconds for';
+const REQ003 = 'The facade exposes a presignGetUrl verb that issues';
+
+function skipRow(variable) {
+  return {
+    anchorAcId: null,
+    verdict: 'pass',
+    detail: `${AC28103_1} - accountBound: skipped (${variable} unset)`,
+    accountBoundSkipped: true,
+    reason: `${variable} unset`,
+    evidence: { skip: true, reason: `${variable} unset`, envDeclared: [...DECLARED_ENV] },
+  };
+}
 
 export default async function runProbe() {
-  const { endpoint, bucket, region, forcePathStyle } = endpointFromEnv();
+  let endpoint, bucket, region, forcePathStyle;
+  try {
+    ({ endpoint, bucket, region, forcePathStyle } = endpointFromEnv());
+  } catch (err) {
+    if (err instanceof MissingS3EndpointError) {
+      return { results: [skipRow(err.variable)], extra: { accountBoundSkipped: true, reason: `${err.variable} unset`, envDeclared: [...DECLARED_ENV] } };
+    }
+    throw err;
+  }
   const credentials = await credentialsFromShim(secretsShim);
   const events = [];
-  const store = createObjectStore({
+  const store = await createObjectStore({
     endpointUrl: endpoint,
     bucket,
     credentialsRef: credentials,
@@ -31,71 +59,92 @@ export default async function runProbe() {
   const body = Buffer.from('presigned url payload');
   try {
     await store.ready();
-    await store.putObject(key, 'text/plain', body);
+    const putRes = await store.putObject(key, 'text/plain', body);
+
+    // AC-28103-1 canonical timing test: TTL=60, fetch within TTL, then
+    // fetch the SAME URL after TTL+2s.
     const ttl = 60;
     const url = await store.presignGetUrl(key, ttl);
+    const urlSha256 = createHash('sha256').update(url).digest('hex');
+    const issuedAt = Date.now();
     const first = await fetch(url);
     const firstBody = Buffer.from(await first.arrayBuffer());
-    const firstPass = first.status === 200 && firstBody.equals(body);
+    const firstStatus = first.status;
+    const firstEqual = firstBody.equals(body);
     const issued = events.find((e) => e.event === 'presignedIssued' && e.key === key && e.ttl === ttl);
     results.push({
       anchorAcId: 'AC-28103-1',
-      verdict: firstPass && issued ? 'pass' : 'fail',
-      detail: firstPass && issued
-        ? `fetch within TTL returned ${first.status} with matching body; presignedIssued fired with ttl=${ttl}`
-        : `firstStatus=${first.status} bodyMatch=${firstBody.equals(body)} issued=${Boolean(issued)}`,
+      verdict: firstStatus === 200 && firstEqual && issued ? 'pass' : 'fail',
+      detail: firstStatus === 200 && firstEqual && issued
+        ? `${AC28103_1} - fetch within TTL returned 200 with matching body; presignedIssued fired with ttl=${ttl}; urlSha256=${urlSha256.slice(0, 12)}`
+        : `${AC28103_1} - firstStatus=${firstStatus} bodyMatch=${firstEqual} issued=${Boolean(issued)}`,
+      evidence: {
+        eTag: (putRes && putRes.eTag) || null,
+        vendorRequestId: (putRes && putRes.requestId) || null,
+        bucketName: bucket,
+        key,
+        ttl,
+        firstStatus,
+        firstBodyBytes: firstBody.length,
+        firstBodyEqual: firstEqual,
+        presignedIssuedEvent: issued || null,
+        urlSha256,
+        elapsedMsSincePresign: Date.now() - issuedAt,
+      },
     });
 
-    // Test TTL expiration: sleep past TTL, expect 403
-    // NOTE: TTL floor probe (below the 1-minute floor) is asserted via a
-    // separate try/catch below to avoid a 60+ second sleep in CI.
-    const shortUrl = await store.presignGetUrl(key, 60);
-    // Sleep past the 60s TTL is too slow for CI: instead we test the
-    // signature-expiry surface by asserting the presign floor refuses.
-    // The 200-then-403 expiration behaviour is asserted at real-time via
-    // the second URL fetch after a much shorter tampered TTL below.
-
-    // Truncated ttl test: use a 1s-expired presign by generating a URL
-    // with a very short (but at-floor) TTL and awaiting past it.
-    const shortTtl = 60;
-    const shortUrl2 = await store.presignGetUrl(key, shortTtl);
-    // We simulate expiry by tampering the X-Amz-Date to a stale value
-    // via SIMULATE_PRESIGN_MALFORMED; the real 200-then-403 timing test
-    // runs with SIMULATE_PRESIGN_EXPIRE=true which sleeps TTL+2 seconds.
-    if (process.env.SIMULATE_PRESIGN_EXPIRE === 'true') {
-      await sleep((shortTtl + 2) * 1000);
-      const second = await fetch(shortUrl2);
-      results.push({
-        anchorAcId: 'AC-28103-1',
-        verdict: second.status === 403 ? 'pass' : 'fail',
-        detail: `after TTL fetch returned ${second.status} (expected 403)`,
-      });
-    } else {
-      // Time-shortened path: presign at floor and immediately corrupt
-      // the signature so the endpoint returns 403 without a wall-clock
-      // wait. This proves the 403-shape on tampered signatures; the
-      // real timing test remains available via SIMULATE_PRESIGN_EXPIRE.
-      const tampered = shortUrl2.replace(/X-Amz-Signature=[^&]*/, 'X-Amz-Signature=deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef');
-      const second = await fetch(tampered);
-      results.push({
-        anchorAcId: 'AC-28103-1',
-        verdict: second.status === 403 ? 'pass' : 'fail',
-        detail: `tampered signature fetch returned ${second.status} (expected 403; set SIMULATE_PRESIGN_EXPIRE=true for full TTL wall-clock)`,
-      });
-    }
+    // Wait past TTL and fetch the SAME URL. AC-28103-1 explicitly says
+    // "the same URL". This is a wall-clock wait; the probe budget
+    // includes it.
+    const waitMs = (ttl + 2) * 1000;
+    await sleep(waitMs);
+    const second = await fetch(url);
+    const secondStatus = second.status;
+    results.push({
+      anchorAcId: 'AC-28103-1',
+      verdict: secondStatus === 403 ? 'pass' : 'fail',
+      detail: secondStatus === 403
+        ? `${AC28103_1} - after TTL+2s the SAME presigned URL (urlSha256=${urlSha256.slice(0, 12)}) returned 403 (AccessDenied / expired-URL family)`
+        : `${AC28103_1} - after TTL+2s the SAME presigned URL returned ${secondStatus}, expected 403`,
+      evidence: {
+        eTag: (putRes && putRes.eTag) || null,
+        vendorRequestId: (putRes && putRes.requestId) || null,
+        bucketName: bucket,
+        key,
+        ttl,
+        waitedMs: waitMs,
+        secondStatus,
+        urlSha256,
+        totalElapsedMsSincePresign: Date.now() - issuedAt,
+      },
+    });
 
-    // Floor refusal (1 minute per ADR-2902)
+    // ADR-2902 floor refusal is not stated by any AC (AC-28103-1
+    // states TTL 60 success/expiry). Anchor to REQ-003 which names
+    // the floor of 1 minute.
     let refusedBelowFloor = false;
-    try { await store.presignGetUrl(key, 30); } catch { refusedBelowFloor = true; }
+    let refusedError = null;
+    try { await store.presignGetUrl(key, 30); } catch (err) { refusedBelowFloor = true; refusedError = err && err.message; }
     results.push({
-      anchorAcId: 'AC-28103-1',
+      anchorReqId: 'object-storage-s3-REQ-003',
       verdict: refusedBelowFloor ? 'pass' : 'fail',
-      detail: refusedBelowFloor ? 'presign below 60s floor refused per ADR-2902' : 'presign below floor did not refuse',
+      detail: refusedBelowFloor
+        ? `${REQ003} - presign below the 60s floor refused per ADR-2902 (${refusedError})`
+        : `${REQ003} - presign below the 60s floor did not refuse`,
+      evidence: {
+        eTag: (putRes && putRes.eTag) || null,
+        vendorRequestId: (putRes && putRes.requestId) || null,
+        bucketName: bucket,
+        requestedTtlSeconds: 30, floorSeconds: 60,
+        refused: refusedBelowFloor, error: refusedError,
+        refusalFired: refusedBelowFloor,
+        refusalCode: refusedBelowFloor ? 'below-floor' : 'accepted',
+      },
     });
 
     await store.deleteObject(key);
   } finally {
     await store.close();
   }
-  return results;
+  return { results, extra: { key } };
 }

package/blueprints/object-storage-s3/contributions/probes/probe-utils.mjs

@@ -25,47 +25,82 @@ export const REPORT_DIR = resolve(PROJECT_ROOT, '.rcf/reports/blueprints/object-
  * - pass otherwise
  */
 export function aggregate(results) {
+  // Empty or null result sets are a FAIL: a probe that emitted no rows
+  // proved nothing (authoring-standard rule 3, criterion e conformance).
+  if (!Array.isArray(results) || results.length === 0) return 'fail';
   if (results.some((r) => r.verdict === 'fail')) return 'fail';
   if (results.some((r) => r.verdict === 'warn')) return 'warn';
   return 'pass';
 }
 
+/**
+ * Return true when every result is an account-bound skip; the
+ * aggregate then flips to pass per spec section 3.5 and authoring
+ * standard section 7d.
+ */
+export function isAccountBoundSkipped(results) {
+  return results.length > 0 && results.every((r) => r.accountBoundSkipped === true);
+}
+
 /**
  * Write the per-blueprint probe report at
  * .rcf/reports/blueprints/object-storage-s3/<probeName>.json
- * per spec section 3.4.
+ * per spec section 3.4. Accepts an optional extra bag that is
+ * spread onto the report envelope (e.g. envDeclared, evidence,
+ * accountBoundSkipped) so real-account probes can surface positive
+ * evidence per authoring standard section 7d.
  */
-export async function writeReport({ probeName, engine, results }) {
+export async function writeReport({ probeName, engine, results, extra }) {
   await mkdir(REPORT_DIR, { recursive: true });
+  const raw = aggregate(results);
+  const aggregateVerdict = isAccountBoundSkipped(results) ? 'pass' : raw;
   const report = {
     slug: 'object-storage-s3',
     probeName,
     runAt: new Date().toISOString(),
     engine,
     results,
-    aggregateVerdict: aggregate(results),
+    aggregateVerdict,
+    ...(extra ?? {}),
   };
   const path = resolve(REPORT_DIR, `${probeName}.json`);
   await writeFile(path, JSON.stringify(report, null, 2), 'utf8');
   return { report, path };
 }
 
+function normaliseMain(value) {
+  if (value == null) {
+    // A probe that returned null / undefined proved nothing (authoring-standard rule 3).
+    return { results: [{ anchorReqId: 'object-storage-s3-REQ-001', verdict: 'fail', detail: 'no checks ran (probe returned null / undefined)', evidence: { probeReturnedNullOrUndefined: true } }], extra: {} };
+  }
+  if (Array.isArray(value)) return { results: value, extra: {} };
+  if (value && Array.isArray(value.results)) {
+    const { results, ...extra } = value;
+    return { results, extra };
+  }
+  throw new Error('probe main must return an array or an object with a results[] field');
+}
+
 /**
  * Drive an async main() and exit 0 on aggregate pass, 1 otherwise.
- * Prints the report JSON to stdout for the gate-reviewer to read.
+ * Prints the report JSON to stdout for the gate-operator to read.
+ * The probe main may return either an array of result records or an
+ * envelope { results, ...extra } whose extra bag is written onto the
+ * report envelope alongside the aggregateVerdict.
  */
 export async function runShim(probeName, engine, mainFn) {
   try {
-    const results = await mainFn();
-    const { report, path } = await writeReport({ probeName, engine, results });
+    const { results, extra } = normaliseMain(await mainFn());
+    const { report, path } = await writeReport({ probeName, engine, results, extra });
     process.stdout.write(JSON.stringify(report, null, 2) + '\n');
     process.stdout.write(`report written to ${path}\n`);
     process.exit(report.aggregateVerdict === 'pass' ? 0 : 1);
   } catch (err) {
     const results = [{
-      anchorAcId: 'unknown',
+      anchorReqId: 'object-storage-s3-REQ-001',
       verdict: 'fail',
       detail: `probe threw: ${err && err.message ? err.message : String(err)}`,
+      evidence: { probeThrew: true, errorMessage: err && err.message ? err.message : String(err), errorName: err && err.name },
     }];
     const { report, path } = await writeReport({ probeName, engine, results });
     process.stdout.write(JSON.stringify(report, null, 2) + '\n');
@@ -83,3 +118,90 @@ export function probeKey(prefix) {
   const suffix = Math.random().toString(36).slice(2, 10);
   return `${prefix}/${Date.now()}-${suffix}`;
 }
+
+/**
+ * Fetch MinIO /minio/health/live for the current run's S3 endpoint and
+ * return an observed engine descriptor:
+ *   { kind: 's3', vendor: 'minio', endpointHost, healthLive: { httpStatus, responseTimeMs, ok } }
+ * Never returns a fabricated healthy: true. A failed probe returns
+ * `{ ok: false, error }` under `healthLive`.
+ */
+export async function observeMinioEngine() {
+  const endpointUrl = process.env.S3_ENDPOINT_URL;
+  if (!endpointUrl) {
+    // S3_ENDPOINT_URL is a required declared variable per the
+    // endpoint-hosts rule; caller records an exact one-variable skip when unset.
+    return { kind: 's3', vendor: 'minio', endpointHost: null, healthLive: { ok: false, error: 'S3_ENDPOINT_URL unset' } };
+  }
+  const url = new URL('/minio/health/live', endpointUrl);
+  const started = Date.now();
+  try {
+    const res = await fetch(url.toString(), { method: 'GET' });
+    return {
+      kind: 's3',
+      vendor: 'minio',
+      endpointHost: url.host,
+      healthLive: {
+        ok: res.status === 200,
+        httpStatus: res.status,
+        responseTimeMs: Date.now() - started,
+        endpoint: url.toString(),
+      },
+    };
+  } catch (err) {
+    return {
+      kind: 's3',
+      vendor: 'minio',
+      endpointHost: url.host,
+      healthLive: {
+        ok: false,
+        error: err && err.message,
+        responseTimeMs: Date.now() - started,
+        endpoint: url.toString(),
+      },
+    };
+  }
+}
+
+/**
+ * Observe R2 by issuing a lightweight ListBuckets against the R2
+ * endpoint from the fixture secrets shim. Returns an engine descriptor
+ * with a real request id and http status. Returns a not-observed
+ * descriptor when the account gate is unset , the probe itself will
+ * account-bound-skip and no wire call should be made here.
+ */
+export async function observeR2Engine() {
+  if (process.env.CI_HAS_CLOUDFLARE_ACCOUNT !== 'true') {
+    return { kind: 's3', vendor: 'cloudflare-r2', observed: false, reason: 'CI_HAS_CLOUDFLARE_ACCOUNT unset' };
+  }
+  try {
+    const { secretsShim } = await import('../../../../packages/rcf-lite/test/fixtures/infra-s3-and-queue/src/secrets.mjs');
+    const { credentialsFromShim } = await import('../../../../packages/rcf-lite/test/fixtures/infra-s3-and-queue/src/object-store.mjs');
+    const { createBucketOps } = await import('../../../../packages/rcf-lite/test/fixtures/infra-s3-and-queue/src/bucket-ops.mjs');
+    const r2 = await secretsShim.getSecret('r2Endpoint');
+    if (!r2 || !r2.endpoint) return { kind: 's3', vendor: 'cloudflare-r2', observed: false, reason: 'r2Endpoint unresolvable' };
+    const credentials = await credentialsFromShim(secretsShim);
+    const ops = createBucketOps({ endpointUrl: r2.endpoint, region: 'auto', credentials, forcePathStyle: false });
+    const started = Date.now();
+    try {
+      const list = await ops.listBuckets();
+      const host = new URL(r2.endpoint).host;
+      return {
+        kind: 's3',
+        vendor: 'cloudflare-r2',
+        endpointHostRedacted: host.replace(/^[0-9a-f]+/, '[account-id]'),
+        listBuckets: {
+          ok: true,
+          httpStatus: list.raw && list.raw.$metadata && list.raw.$metadata.httpStatusCode,
+          requestId: list.raw && list.raw.$metadata && list.raw.$metadata.requestId,
+          bucketCount: list.buckets.length,
+          responseTimeMs: Date.now() - started,
+        },
+      };
+    } finally {
+      ops.close();
+    }
+  } catch (err) {
+    return { kind: 's3', vendor: 'cloudflare-r2', observed: false, error: err && err.message };
+  }
+}

package/blueprints/object-storage-s3/contributions/probes/put-get-round-trip.mjs

@@ -9,15 +9,40 @@
  * Anchors AC-28102-1, AC-28102-2, AC-28102-3.
  */
 
-import { createObjectStore, endpointFromEnv, credentialsFromShim } from '../../../../packages/rcf-lite/test/fixtures/infra-s3-and-queue/src/object-store.mjs';
+import { createObjectStore, endpointFromEnv, credentialsFromShim, MissingS3EndpointError } from '../../../../packages/rcf-lite/test/fixtures/infra-s3-and-queue/src/object-store.mjs';
 import { secretsShim } from '../../../../packages/rcf-lite/test/fixtures/infra-s3-and-queue/src/secrets.mjs';
 import { probeKey } from './probe-utils.mjs';
 
+export const DECLARED_ENV = Object.freeze(['S3_ENDPOINT_URL']);
+
+const AC28102_1 = 'Given a putObject through the facade for a';
+const AC28102_2 = 'Given a deleteObject through the facade for a';
+const AC28102_3 = 'Given at least three objects put under a';
+
+function skipRow(variable) {
+  return {
+    anchorAcId: null,
+    verdict: 'pass',
+    detail: `${AC28102_1} - accountBound: skipped (${variable} unset)`,
+    accountBoundSkipped: true,
+    reason: `${variable} unset`,
+    evidence: { skip: true, reason: `${variable} unset`, envDeclared: [...DECLARED_ENV] },
+  };
+}
+
 export default async function runProbe() {
-  const { endpoint, bucket, region, forcePathStyle } = endpointFromEnv();
+  let endpoint, bucket, region, forcePathStyle;
+  try {
+    ({ endpoint, bucket, region, forcePathStyle } = endpointFromEnv());
+  } catch (err) {
+    if (err instanceof MissingS3EndpointError) {
+      return { results: [skipRow(err.variable)], extra: { accountBoundSkipped: true, reason: `${err.variable} unset`, envDeclared: [...DECLARED_ENV] } };
+    }
+    throw err;
+  }
   const credentials = await credentialsFromShim(secretsShim);
   const events = [];
-  const store = createObjectStore({
+  const store = await createObjectStore({
     endpointUrl: endpoint,
     bucket,
     credentialsRef: credentials,
@@ -29,9 +54,11 @@ export default async function runProbe() {
   const key = probeKey('probe/put-get');
   const body = Buffer.alloc(1024, 0x41); // 1 KiB of A
   const contentType = 'application/octet-stream';
+  const prefix = probeKey('probe/list-parent');
+  const listKeys = [`${prefix}/a`, `${prefix}/b`, `${prefix}/c`];
   try {
     await store.ready();
-    await store.putObject(key, contentType, body);
+    const putRes = await store.putObject(key, contentType, body);
     const got = await store.getObject(key);
     const roundTripPass = got.body.length === 1024
       && got.body.equals(body)
@@ -42,24 +69,39 @@ export default async function runProbe() {
       anchorAcId: 'AC-28102-1',
       verdict: roundTripPass && eventPass ? 'pass' : 'fail',
       detail: roundTripPass && eventPass
-        ? `1 KiB round-trip byte-equal; objectPut fired with size=${putEvent.size}`
-        : `roundTripPass=${roundTripPass} eventPass=${eventPass} got.size=${got.body.length}`,
+        ? `${AC28102_1} - 1 KiB round-trip byte-equal; objectPut fired with size=${putEvent.size}`
+        : `${AC28102_1} - roundTripPass=${roundTripPass} eventPass=${eventPass} got.size=${got.body.length}`,
+      evidence: {
+        vendorRequestId: (putRes && putRes.requestId) || (got && got.requestId) || null,
+        eTag: (putRes && putRes.eTag) || (got && got.eTag) || null,
+        bucketName: bucket, key,
+        requestedContentType: contentType, gotContentType: got.contentType,
+        gotSize: got.body.length, byteEqual: got.body.equals(body),
+        objectPutEvent: putEvent || null,
+      },
     });
 
     // list under prefix
-    const prefix = probeKey('probe/list-parent');
-    const listKeys = [`${prefix}/a`, `${prefix}/b`, `${prefix}/c`];
-    for (const k of listKeys) await store.putObject(k, 'text/plain', Buffer.from(k));
+    const listPuts = [];
+    for (const k of listKeys) listPuts.push(await store.putObject(k, 'text/plain', Buffer.from(k)));
     const listed = await store.listObjects(prefix);
     const listPass = listKeys.every((k) => listed.keys.includes(k)) && typeof listed.isTruncated === 'boolean';
     results.push({
       anchorAcId: 'AC-28102-3',
       verdict: listPass ? 'pass' : 'fail',
-      detail: listPass ? `list returned ${listed.keys.length} keys with isTruncated=${listed.isTruncated}` : `listed=${JSON.stringify(listed)}`,
+      detail: listPass
+        ? `${AC28102_3} - list returned ${listed.keys.length} keys with isTruncated=${listed.isTruncated}`
+        : `${AC28102_3} - listed=${JSON.stringify(listed)}`,
+      evidence: {
+        vendorRequestId: (listed && listed.requestId) || (listPuts.find((p) => p && p.requestId) || {}).requestId || null,
+        bucketName: bucket, prefix,
+        expectedKeys: listKeys, returnedKeys: listed.keys,
+        isTruncated: listed.isTruncated,
+      },
     });
 
     // delete and confirm 404
-    await store.deleteObject(key);
+    const delRes = await store.deleteObject(key);
     let deletedEvent = events.find((e) => e.event === 'objectDeleted' && e.key === key);
     let notFound = false;
     try { await store.getObject(key); } catch (err) {
@@ -70,15 +112,35 @@ export default async function runProbe() {
       anchorAcId: 'AC-28102-2',
       verdict: deletedEvent && notFound ? 'pass' : 'fail',
       detail: deletedEvent && notFound
-        ? 'objectDeleted fired and get after delete returned NoSuchKey'
-        : `deletedEvent=${Boolean(deletedEvent)} notFound=${notFound}`,
+        ? `${AC28102_2} - objectDeleted fired and get after delete returned NoSuchKey`
+        : `${AC28102_2} - deletedEvent=${Boolean(deletedEvent)} notFound=${notFound}`,
+      evidence: {
+        vendorRequestId: (delRes && delRes.requestId) || null,
+        bucketName: bucket, key,
+        objectDeletedEvent: deletedEvent || null,
+        getAfterDeleteWasNotFound: notFound,
+      },
     });
-    // clean up the list keys
+    // Teardown: delete the list keys and close the facade. Every
+    // teardown step is recorded on the teardown[] accumulator and any
+    // failure emits its own row (authoring-standard rule 5).
+  } finally {
+    const teardown = [];
     for (const k of listKeys) {
-      try { await store.deleteObject(k); } catch { /* ignore */ }
+      try { await store.deleteObject(k); teardown.push({ step: `deleteObject ${k}`, ok: true }); }
+      catch (err) { teardown.push({ step: `deleteObject ${k}`, ok: false, error: err && err.message }); }
+    }
+    try { await store.close(); teardown.push({ step: 'facade close', ok: true }); }
+    catch (err) { teardown.push({ step: 'facade close', ok: false, error: err && err.message }); }
+    const failed = teardown.filter((t) => !t.ok);
+    if (failed.length > 0) {
+      results.push({
+        anchorReqId: 'object-storage-s3-REQ-002',
+        verdict: 'fail',
+        detail: `The facade exposes named domain verbs (putObject, getObject, - teardown FAILED: ${failed.map((t) => `${t.step} -> ${t.error}`).join('; ')}`,
+        evidence: { teardown },
+      });
     }
-  } finally {
-    await store.close();
   }
-  return results;
+  return { results, extra: { envDeclared: [...DECLARED_ENV] } };
 }