rcf-lite 0.27.0 → 0.28.0

package/blueprints/object-storage-s3/contributions/probes/r2-real-account-smoke.mjs

@@ -1,64 +1,318 @@
 /**
  * R2 real-account smoke probe.
  *
- * Opens the facade against a real Cloudflare R2 bucket (endpoint URL,
- * bucket, and credential pair read via security-secrets-management),
- * puts a 1 KiB payload, gets it back, asserts byte equality, deletes
- * the temporary object.
+ * Against a real Cloudflare R2 account (credentials read via the
+ * fixture's secrets shim), the probe:
  *
- * accountBound: true. Skipped in CI without CI_HAS_CLOUDFLARE_ACCOUNT
- * per infra round 5 spec section 3.5.
+ *   1. mints a scratch bucket via S3 CreateBucket,
+ *   2. positively records the bucket present in an S3 ListBuckets
+ *      inventory diff (post-create),
+ *   3. opens the shipped facade against that scratch bucket, puts a
+ *      1 KiB payload, gets it back byte-equal, lists to prove the key
+ *      is present, deletes the object, lists again to prove it is
+ *      absent (real inventory diff; a failed list is a FAIL, never an
+ *      empty inventory),
+ *   4. deletes the scratch bucket via S3 DeleteBucket and confirms it
+ *      is absent from a post-run ListBuckets inventory diff, recording
+ *      the HTTP status of the DeleteBucket call and the ListBuckets
+ *      call on the row itself.
  *
- * Anchors AC-28108-1.
+ * Each result row carries its own evidence object; skip records
+ * follow the one-unset-variable-per-row rule.
+ *
+ * Row anchoring:
+ *  - The account-bound skip anchors AC-28108-1 (the skip acceptance).
+ *  - The object round trip + inventory diff anchor AC-28108-2 (the
+ *    live-account round trip).
+ *  - Bucket lifecycle rows (bucket create / bucket delete / post-run
+ *    bucket-inventory diff) are recorded as `conformanceOnly: true`
+ *    with `anchorAcId: null`: no shipped AC states bucket-lifecycle
+ *    behaviour, and REQ-002's verb contract is the four object-level
+ *    verbs (putObject / getObject / deleteObject / listObjects), not
+ *    CreateBucket / DeleteBucket / ListBuckets. The `limitation`
+ *    field on each row names REQ-002 and explains the gap so a
+ *    reader sees the property that was NOT observed alongside the
+ *    observation that WAS made.
+ *  - Endpoint-resolution failure after the preflight gates all pass
+ *    is a FAIL anchored to REQ-001 (facade opens on boot), never a
+ *    compound account skip.
+ *
+ * accountBound: true.
  */
 
-import { createObjectStore, credentialsFromShim } from '../../../../packages/rcf-lite/test/fixtures/infra-s3-and-queue/src/object-store.mjs';
-import { secretsShim } from '../../../../packages/rcf-lite/test/fixtures/infra-s3-and-queue/src/secrets.mjs';
 import { probeKey } from './probe-utils.mjs';
 
 export const accountBound = true;
+export const DECLARED_ENV = Object.freeze([
+  'CI_HAS_CLOUDFLARE_ACCOUNT',
+  'R2_ACCOUNT_ID',
+  'R2_BUCKET',
+  'S3_ACCESS_KEY_ID',
+  'S3_SECRET_ACCESS_KEY',
+]);
 
-export default async function runProbe() {
-  if (!process.env.CI_HAS_CLOUDFLARE_ACCOUNT) {
-    return [{
+const AC28108_1_FIRST8 = 'Given CI_HAS_CLOUDFLARE_ACCOUNT is unset, when the r2-real-account-smoke.mjs shim';
+const AC28108_2_FIRST8 = 'Given CI_HAS_CLOUDFLARE_ACCOUNT set alongside a real R2 endpoint';
+const REQ001_FIRST8 = 'The application accesses object storage through a single';
+const AC28108_2_INVENTORY_LIMITATION = 'AC-28108-2: Given CI_HAS_CLOUDFLARE_ACCOUNT set alongside a real R2 endpoint URL, bucket name, and credential pair (all from security-secrets-management), when the r2-real-account-smoke.mjs shim runs, then the facade opens against the R2 bucket, puts a 1 KiB payload, gets it back byte-equal, deletes the temporary object on exit, and the report carries aggregateVerdict pass with accountBoundSkipped absent or false. Not observed on this row: the object round-trip clause is observed on the byte-equal put/get row that anchors AC-28108-2 with the engine-returned ETag; this row records the per-object inventory diff (listObjects before delete, delete, listObjects after delete) which R2 does not surface a per-object engine-returned identifier for (S3 SDK $metadata.requestId returns null on Cloudflare R2 for object-level verbs).';
+const AC28108_2_BUCKET_LIMITATION = 'AC-28108-2: Given CI_HAS_CLOUDFLARE_ACCOUNT set alongside a real R2 endpoint URL, bucket name, and credential pair (all from security-secrets-management), when the r2-real-account-smoke.mjs shim runs, then the facade opens against the R2 bucket, puts a 1 KiB payload, gets it back byte-equal, deletes the temporary object on exit, and the report carries aggregateVerdict pass with accountBoundSkipped absent or false. Not observed on this row: the AC states an object-level round trip on an already-provisioned bucket; this row records bucket-level lifecycle (CreateBucket / DeleteBucket / ListBuckets), which the AC does not state.';
+
+function skipResult(reason) {
+  return {
+    results: [{
       anchorAcId: 'AC-28108-1',
       verdict: 'pass',
-      detail: 'accountBound: skipped (no CI_HAS_CLOUDFLARE_ACCOUNT)',
+      detail: `${AC28108_1_FIRST8} - accountBound: skipped (${reason})`,
       accountBoundSkipped: true,
-    }];
-  }
+      reason,
+      evidence: { skip: true, reason, envDeclared: [...DECLARED_ENV] },
+    }],
+    extra: { accountBoundSkipped: true, reason, envDeclared: [...DECLARED_ENV] },
+  };
+}
+
+function shortId() {
+  return Math.random().toString(36).slice(2, 8);
+}
+
+export default async function runProbe() {
+  const gate = process.env.CI_HAS_CLOUDFLARE_ACCOUNT;
+  if (gate == null || gate === '') return skipResult('CI_HAS_CLOUDFLARE_ACCOUNT unset');
+  if (gate !== 'true') return skipResult('CI_HAS_CLOUDFLARE_ACCOUNT (not "true")');
+  if (!process.env.R2_ACCOUNT_ID) return skipResult('R2_ACCOUNT_ID unset');
+  if (!process.env.R2_BUCKET) return skipResult('R2_BUCKET unset');
+  if (!process.env.S3_ACCESS_KEY_ID) return skipResult('S3_ACCESS_KEY_ID unset');
+  if (!process.env.S3_SECRET_ACCESS_KEY) return skipResult('S3_SECRET_ACCESS_KEY unset');
+
+  const { createObjectStore, credentialsFromShim } = await import('../../../../packages/rcf-lite/test/fixtures/infra-s3-and-queue/src/object-store.mjs');
+  const { secretsShim } = await import('../../../../packages/rcf-lite/test/fixtures/infra-s3-and-queue/src/secrets.mjs');
+  const { createBucketOps } = await import('../../../../packages/rcf-lite/test/fixtures/infra-s3-and-queue/src/bucket-ops.mjs');
+
   const r2 = await secretsShim.getSecret('r2Endpoint');
-  if (!r2) {
-    return [{
-      anchorAcId: 'AC-28108-1',
-      verdict: 'fail',
-      detail: 'CI_HAS_CLOUDFLARE_ACCOUNT set but r2Endpoint secret missing (R2_ACCOUNT_ID and R2_BUCKET required via security-secrets-management)',
-    }];
+  if (!r2 || !r2.endpoint) {
+    // All preflight gates passed; endpoint resolution failure is a
+    // real facade-open failure, not an account-bound skip.
+    return {
+      results: [{
+        anchorReqId: 'object-storage-s3-REQ-001',
+        verdict: 'fail',
+        detail: `${REQ001_FIRST8} - endpoint could not be resolved from the secrets shim after all preflight gates passed; this is a facade-open failure, not an account skip`,
+        evidence: { endpointResolved: false, envDeclared: [...DECLARED_ENV] },
+      }],
+      extra: { envDeclared: [...DECLARED_ENV] },
+    };
   }
   const credentials = await credentialsFromShim(secretsShim);
-  const events = [];
-  const store = createObjectStore({
+  const scratchBucket = `qa-e-s3-${shortId()}`;
+  const endpointHostRedacted = new URL(r2.endpoint).host.replace(/^[0-9a-f]+/, '[account-id]');
+  const evidence = { endpointHostRedacted, scratchBucket, envDeclared: [...DECLARED_ENV] };
+  const results = [];
+  const teardown = { deleteObject: null, deleteBucket: null, bucketAbsentAfter: null };
+  const bucketOps = createBucketOps({
     endpointUrl: r2.endpoint,
-    bucket: r2.bucket,
-    credentialsRef: credentials,
     region: 'auto',
+    credentials: { accessKeyId: credentials.accessKeyId, secretAccessKey: credentials.secretAccessKey },
     forcePathStyle: false,
-    onEvent: (e) => events.push(e),
   });
-  const key = probeKey('probe/r2-smoke');
-  const body = Buffer.alloc(1024, 0x52);
+
+  let bucketCreated = false;
+  let store = null;
   try {
+    // 1) Create scratch bucket (anchor REQ-002: put verb).
+    const create = await bucketOps.createBucket(scratchBucket);
+    bucketCreated = true;
+    const createHttpStatus = create && create.$metadata && create.$metadata.httpStatusCode;
+    const createRequestId = create && create.$metadata && create.$metadata.requestId;
+
+    // 2) Inventory diff (REQ-002 list verb): post-create bucket must
+    // appear on ListBuckets. Failed list is a FAIL.
+    let bucketsAfterCreate;
+    let listAfterCreateHttpStatus;
+    let listAfterCreateRequestId;
+    try {
+      const list = await bucketOps.listBuckets();
+      bucketsAfterCreate = list.buckets;
+      listAfterCreateHttpStatus = list.raw && list.raw.$metadata && list.raw.$metadata.httpStatusCode;
+      listAfterCreateRequestId = list.raw && list.raw.$metadata && list.raw.$metadata.requestId;
+    } catch (err) {
+      results.push({
+        anchorAcId: null,
+        conformanceOnly: true,
+        limitation: AC28108_2_BUCKET_LIMITATION,
+        verdict: 'fail',
+        detail: `conformanceOnly (${AC28108_2_BUCKET_LIMITATION}) - ListBuckets after CreateBucket threw: ${err && err.message}; failed inventory is a FAIL`,
+        evidence: { scratchBucket, error: err && err.message, endpointHostRedacted },
+      });
+      throw err;
+    }
+    const seenAfterCreate = bucketsAfterCreate.includes(scratchBucket);
+    results.push({
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: AC28108_2_BUCKET_LIMITATION,
+      verdict: seenAfterCreate ? 'pass' : 'fail',
+      detail: seenAfterCreate
+        ? `conformanceOnly (${AC28108_2_BUCKET_LIMITATION}) - scratch bucket ${scratchBucket} present in ListBuckets after CreateBucket (positive inventory diff on bucket-level lifecycle)`
+        : `conformanceOnly (${AC28108_2_BUCKET_LIMITATION}) - scratch bucket ${scratchBucket} NOT in ListBuckets after CreateBucket; buckets=${JSON.stringify(bucketsAfterCreate)}`,
+      evidence: {
+        scratchBucket,
+        seenAfterCreate,
+        bucketCount: bucketsAfterCreate.length,
+        createBucketHttpStatus: createHttpStatus,
+        createBucketRequestId: createRequestId,
+        listBucketsHttpStatus: listAfterCreateHttpStatus,
+        listBucketsRequestId: listAfterCreateRequestId,
+        endpointHostRedacted,
+      },
+    });
+
+    // 3) Open facade against scratch bucket and round-trip (AC-28108-2).
+    const events = [];
+    store = await createObjectStore({
+      endpointUrl: r2.endpoint,
+      bucket: scratchBucket,
+      credentialsRef: credentials,
+      region: 'auto',
+      forcePathStyle: false,
+      onEvent: (e) => events.push(e),
+    });
     await store.ready();
-    await store.putObject(key, 'application/octet-stream', body);
+    const key = probeKey('qa-e-s3/r2-smoke');
+    const body = Buffer.alloc(1024, 0x52);
+    const put = await store.putObject(key, 'application/octet-stream', body);
     const got = await store.getObject(key);
-    const pass = got.body.length === 1024 && got.body.equals(body);
-    return [{
-      anchorAcId: 'AC-28108-1',
-      verdict: pass ? 'pass' : 'fail',
-      detail: pass ? `R2 round-trip byte-equal against ${r2.endpoint}/${r2.bucket}` : 'R2 round-trip failed byte equality',
-    }];
+    const roundTripEqual = got.body.length === body.length && got.body.equals(body);
+    results.push({
+      anchorAcId: 'AC-28108-2',
+      verdict: roundTripEqual ? 'pass' : 'fail',
+      detail: roundTripEqual
+        ? `${AC28108_2_FIRST8} - R2 round-trip byte-equal against ${scratchBucket} through the shipped facade; putObject returned size=${put.size}, getObject body length=${got.body.length}`
+        : `${AC28108_2_FIRST8} - R2 round-trip failed byte equality; got ${got.body.length} expected ${body.length}`,
+      evidence: {
+        eTag: (put && put.eTag) || (got && got.eTag) || null,
+        vendorRequestId: (put && put.requestId) || (got && got.requestId) || null,
+        scratchBucket,
+        key,
+        putReturnedSize: put.size,
+        getSize: got.body.length,
+        byteEqual: roundTripEqual,
+        objectPutEvent: events.find((e) => e.event === 'objectPut') || null,
+        endpointHostRedacted,
+      },
+    });
+
+    // Real per-object inventory diff (AC-28108-2 covers the delete on
+    // exit). A failed list is a FAIL.
+    let listBefore;
+    try { listBefore = await store.listObjects(key); }
+    catch (err) {
+      results.push({
+        anchorAcId: 'AC-28108-2',
+        verdict: 'fail',
+        detail: `${AC28108_2_FIRST8} - listObjects before delete threw: ${err && err.message}`,
+        evidence: { scratchBucket, key, error: err && err.message },
+      });
+      throw err;
+    }
+    const seenBefore = listBefore.keys.includes(key);
+    const delRes = await store.deleteObject(key);
+    teardown.deleteObject = { key, ok: true, requestId: (delRes && delRes.requestId) || null };
+    let listAfter;
+    try { listAfter = await store.listObjects(key); }
+    catch (err) {
+      results.push({
+        anchorAcId: 'AC-28108-2',
+        verdict: 'fail',
+        detail: `${AC28108_2_FIRST8} - listObjects after delete threw: ${err && err.message}`,
+        evidence: { scratchBucket, key, error: err && err.message },
+      });
+      throw err;
+    }
+    const seenAfter = listAfter.keys.includes(key);
+    const inventoryPass = seenBefore && !seenAfter;
+    // R2 does not surface a per-object $metadata.requestId on the
+    // object-level list/delete verbs, so the inventory-diff row has
+    // no engine-returned scalar id. The AC-28108-2 object round-trip
+    // clause is anchored on the byte-equal put/get row above (which
+    // carries the engine-returned ETag). This row is conformanceOnly
+    // and records the per-object inventory diff as positive evidence
+    // toward AC-28108-2 without falsely counting as an anchor.
+    results.push({
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: AC28108_2_INVENTORY_LIMITATION,
+      verdict: inventoryPass ? 'pass' : 'fail',
+      detail: inventoryPass
+        ? `conformanceOnly (${AC28108_2_INVENTORY_LIMITATION}) - object inventory diff proves create+delete: key present before delete, absent after (listObjects returned ${listBefore.keys.length} then ${listAfter.keys.length} keys)`
+        : `conformanceOnly (${AC28108_2_INVENTORY_LIMITATION}) - inventory diff mismatch: seenBefore=${seenBefore} seenAfter=${seenAfter}`,
+      evidence: {
+        scratchBucket,
+        key,
+        seenBefore,
+        seenAfter,
+        keysBeforeCount: listBefore.keys.length,
+        keysAfterCount: listAfter.keys.length,
+        endpointHostRedacted,
+      },
+    });
   } finally {
-    try { await store.deleteObject(key); } catch { /* best effort */ }
-    await store.close();
+    if (store) {
+      try { await store.close(); }
+      catch (err) { teardown.facadeClose = { ok: false, error: err && err.message }; }
+    }
+    if (bucketCreated) {
+      let deleteBucketErr = null;
+      let del = null;
+      try {
+        del = await bucketOps.deleteBucket(scratchBucket);
+        teardown.deleteBucket = {
+          bucket: scratchBucket,
+          ok: true,
+          httpStatus: del && del.$metadata && del.$metadata.httpStatusCode,
+          requestId: del && del.$metadata && del.$metadata.requestId,
+        };
+      } catch (err) {
+        deleteBucketErr = err;
+        teardown.deleteBucket = { bucket: scratchBucket, ok: false, error: err && err.message };
+      }
+      // Post-run bucket inventory
+      let postList = null;
+      try {
+        postList = await bucketOps.listBuckets();
+        const stillThere = postList.buckets.includes(scratchBucket);
+        teardown.bucketAbsentAfter = {
+          ok: !stillThere,
+          bucketCount: postList.buckets.length,
+          httpStatus: postList.raw && postList.raw.$metadata && postList.raw.$metadata.httpStatusCode,
+          requestId: postList.raw && postList.raw.$metadata && postList.raw.$metadata.requestId,
+        };
+      } catch (err) {
+        teardown.bucketAbsentAfter = { ok: false, error: err && err.message };
+      }
+      const facadeCloseOk = !teardown.facadeClose || teardown.facadeClose.ok !== false;
+      const teardownOk = teardown.deleteBucket && teardown.deleteBucket.ok
+        && teardown.bucketAbsentAfter && teardown.bucketAbsentAfter.ok
+        && facadeCloseOk;
+      results.push({
+        anchorAcId: null,
+        conformanceOnly: true,
+        limitation: AC28108_2_BUCKET_LIMITATION,
+        verdict: teardownOk ? 'pass' : 'fail',
+        detail: teardownOk
+          ? `conformanceOnly (${AC28108_2_BUCKET_LIMITATION}) - scratch bucket ${scratchBucket} deleted and confirmed absent from post-run ListBuckets (deleteBucket http=${teardown.deleteBucket.httpStatus}, listBuckets http=${teardown.bucketAbsentAfter.httpStatus})`
+          : `conformanceOnly (${AC28108_2_BUCKET_LIMITATION}) - bucket teardown FAILED: deleteBucket=${JSON.stringify(teardown.deleteBucket)}; bucketAbsentAfter=${JSON.stringify(teardown.bucketAbsentAfter)}; facadeClose=${JSON.stringify(teardown.facadeClose)}${deleteBucketErr ? ` deleteBucketError=${deleteBucketErr.message}` : ''}`,
+        evidence: {
+          teardown,
+          scratchBucket,
+          deleteBucketHttpStatus: teardown.deleteBucket && teardown.deleteBucket.httpStatus,
+          deleteBucketRequestId: teardown.deleteBucket && teardown.deleteBucket.requestId,
+          postRunListHttpStatus: teardown.bucketAbsentAfter && teardown.bucketAbsentAfter.httpStatus,
+          postRunListRequestId: teardown.bucketAbsentAfter && teardown.bucketAbsentAfter.requestId,
+          facadeCloseOk,
+        },
+      });
+    }
+    bucketOps.close();
   }
+  return { results, extra: { evidence, envDeclared: [...DECLARED_ENV], teardown } };
 }

package/blueprints/object-storage-s3/contributions/probes/run-event-secrecy.mjs

@@ -1,4 +1,10 @@
+/**
+ * Shim: run event-secrecy against the sample-app fixture. The engine
+ * descriptor carries a REAL health observation (MinIO /minio/health/live
+ * fetch outcome), not a fabricated healthy flag.
+ */
 import runProbe from './event-secrecy.mjs';
-import { runShim } from './probe-utils.mjs';
-const engine = { kind: 's3', image: 'minio/minio', healthy: true };
+import { runShim, observeMinioEngine } from './probe-utils.mjs';
+
+const engine = await observeMinioEngine();
 runShim('event-secrecy', engine, runProbe);

package/blueprints/object-storage-s3/contributions/probes/run-facade-round-trip.mjs

@@ -1,10 +1,10 @@
 /**
- * Shim: run facade-round-trip against the sample-app fixture and write
- * .rcf/reports/blueprints/object-storage-s3/facade-round-trip.json.
+ * Shim: run facade-round-trip against the sample-app fixture. The engine
+ * descriptor carries a REAL health observation (MinIO /minio/health/live
+ * fetch outcome), not a fabricated healthy flag.
  */
-
 import runProbe from './facade-round-trip.mjs';
-import { runShim } from './probe-utils.mjs';
+import { runShim, observeMinioEngine } from './probe-utils.mjs';
 
-const engine = { kind: 's3', image: 'minio/minio', healthy: true };
+const engine = await observeMinioEngine();
 runShim('facade-round-trip', engine, runProbe);

package/blueprints/object-storage-s3/contributions/probes/run-hetzner-object-storage-round-trip.mjs

@@ -1,11 +1,14 @@
 /**
- * Shim: run hetzner-object-storage-round-trip against the extended
- * infra-s3-and-queue fixture and write
- * .rcf/reports/blueprints/object-storage-s3/hetzner-object-storage-round-trip.json.
+ * Shim: run hetzner-object-storage-round-trip. Without the account
+ * gate the engine descriptor is `observed: false` naming the missing
+ * gate; a live run would carry a real request id + http status on the
+ * engine, but a real Hetzner branch is not exercised here (the probe
+ * account-bound-skips honestly).
  */
-
 import runProbe from './hetzner-object-storage-round-trip.mjs';
 import { runShim } from './probe-utils.mjs';
 
-const engine = { kind: 's3', image: 'hetzner-object-storage-cloud', healthy: true };
+const engine = process.env.CI_HAS_HETZNER_OBJECT_STORAGE === 'true'
+  ? { kind: 's3', vendor: 'hetzner-object-storage', observed: false, note: 'live run recorded per-request on the probe result rows' }
+  : { kind: 's3', vendor: 'hetzner-object-storage', observed: false, reason: 'CI_HAS_HETZNER_OBJECT_STORAGE unset' };
 runShim('hetzner-object-storage-round-trip', engine, runProbe);

package/blueprints/object-storage-s3/contributions/probes/run-multipart-upload.mjs

@@ -1,4 +1,10 @@
+/**
+ * Shim: run multipart-upload against the sample-app fixture. The engine
+ * descriptor carries a REAL health observation (MinIO /minio/health/live
+ * fetch outcome), not a fabricated healthy flag.
+ */
 import runProbe from './multipart-upload.mjs';
-import { runShim } from './probe-utils.mjs';
-const engine = { kind: 's3', image: 'minio/minio', healthy: true };
+import { runShim, observeMinioEngine } from './probe-utils.mjs';
+
+const engine = await observeMinioEngine();
 runShim('multipart-upload', engine, runProbe);

package/blueprints/object-storage-s3/contributions/probes/run-presigned-url.mjs

@@ -1,4 +1,10 @@
+/**
+ * Shim: run presigned-url against the sample-app fixture. The engine
+ * descriptor carries a REAL health observation (MinIO /minio/health/live
+ * fetch outcome), not a fabricated healthy flag.
+ */
 import runProbe from './presigned-url.mjs';
-import { runShim } from './probe-utils.mjs';
-const engine = { kind: 's3', image: 'minio/minio', healthy: true };
+import { runShim, observeMinioEngine } from './probe-utils.mjs';
+
+const engine = await observeMinioEngine();
 runShim('presigned-url', engine, runProbe);

package/blueprints/object-storage-s3/contributions/probes/run-put-get-round-trip.mjs

@@ -1,7 +1,10 @@
 /**
- * Shim: run put-get-round-trip against the sample-app fixture.
+ * Shim: run put-get-round-trip against the sample-app fixture. The engine
+ * descriptor carries a REAL health observation (MinIO /minio/health/live
+ * fetch outcome), not a fabricated healthy flag.
  */
 import runProbe from './put-get-round-trip.mjs';
-import { runShim } from './probe-utils.mjs';
-const engine = { kind: 's3', image: 'minio/minio', healthy: true };
+import { runShim, observeMinioEngine } from './probe-utils.mjs';
+
+const engine = await observeMinioEngine();
 runShim('put-get-round-trip', engine, runProbe);

package/blueprints/object-storage-s3/contributions/probes/run-r2-real-account-smoke.mjs

@@ -1,4 +1,12 @@
+/**
+ * Shim: run r2-real-account-smoke. The engine descriptor carries a
+ * real observation (an S3 ListBuckets against the R2 endpoint from
+ * the fixture secrets shim, returning a real requestId + httpStatus)
+ * when the account gate is set, otherwise a not-observed descriptor
+ * that names the missing gate.
+ */
 import runProbe from './r2-real-account-smoke.mjs';
-import { runShim } from './probe-utils.mjs';
-const engine = { kind: 's3', image: 'cloudflare-r2', healthy: true };
+import { runShim, observeR2Engine } from './probe-utils.mjs';
+
+const engine = await observeR2Engine();
 runShim('r2-real-account-smoke', engine, runProbe);

package/blueprints/object-storage-s3/contributions/requirements/object-storage-s3-req-006.json

@@ -2,7 +2,7 @@
   "reqId": "object-storage-s3-REQ-006",
   "prdId": "PRD-001",
   "title": "Credential-pair discipline via security-secrets-management; refuses composition without",
-  "description": "The credential pair (accessKeyId, secretAccessKey) required to sign S3 requests is a secretRef value delegated to security-secrets-management: an opaque string agreed between object-storage-s3 and security-secrets-management naming the secret entry, never the credential value itself. The apply verb refuses composition on a project that has NOT applied security-secrets-management with exit code 3 and the stable message id object-storage-s3-no-secrets on stderr, per infra round 5 spec section 5.2 (maintainer decision). The refusal names the required predecessor blueprint (security-secrets-management) and the override flag (--allow-no-secrets-yet). The override records a note on the applied blueprint's source.notes so rcf define validate can later flag the surface as not-yet-activated. The compose-test path checks the pair through the applied secrets facade before the object-store facade opens. The facade factory accepts only the opaque secretRef and a resolver callback: the applying project passes an unresolved secretRef ({ id, provider }) plus a resolver that dereferences it inside the facade module. The factory refuses a plain { accessKeyId, secretAccessKey } object at the boundary; the resolver runs once per boot inside the module and never leaks the resolved pair beyond the S3 client construction call.",
+  "description": "The credential pair (accessKeyId, secretAccessKey) required to sign S3 requests is a secretRef value delegated to security-secrets-management: an opaque string agreed between object-storage-s3 and security-secrets-management naming the secret entry, never the credential value itself. The apply verb refuses composition on a project that has NOT applied security-secrets-management with exit code 3 and the stable message id object-storage-s3-no-secrets on stderr (sibling reservation). The refusal names the required predecessor blueprint (security-secrets-management) and the override flag (--allow-no-secrets-yet). The override records a note on the applied blueprint's source.notes so rcf define validate can later flag the surface as not-yet-activated. The compose-test path checks the pair through the applied secrets facade before the object-store facade opens. The facade factory accepts only the opaque secretRef and a resolver callback: the applying project passes an unresolved secretRef ({ id, provider }) plus a resolver that dereferences it inside the facade module. The factory refuses a plain { accessKeyId, secretAccessKey } object at the boundary; the resolver runs once per boot inside the module and never leaks the resolved pair beyond the S3 client construction call.",
   "category": "security",
   "domain": "object-storage",
   "priority": "must",

package/blueprints/object-storage-s3/docs/topics.md

@@ -58,7 +58,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | platform-docker-compose-host | 38101-38899 | 39xx | shipped v1.0.0 | `containerHostContract` |
 | edge-cloudflare-tunnel | 39101-39899 | 40xx | shipped v1.0.0 | `edgeIngressBridge` |
 
-US 28101-28108 sit at the LOW end of the 28101-28899 band on purpose (watchpost run-4 lesson). A project-side story mechanically derived from an object-storage-s3 REQ id into the number 28110 would collide against a shipped US-28110; band headroom (28109-28899) leaves that space.
+US 28101-28108 sit at the LOW end of the 28101-28899 band on purpose. A project-side story mechanically derived from an object-storage-s3 REQ id into the number 28110 would collide against a shipped US-28110; band headroom (28109-28899) leaves that space.
 
 ADR/TAC suffixes for this blueprint use the 2901-2999 block, continuing the shelf pattern.
 

package/blueprints/object-storage-s3/guide/object-storage-s3.md

@@ -55,7 +55,7 @@ await store.deleteObject('uploads/report.pdf');
 const { keys, isTruncated } = await store.listObjects('uploads/');
 ```
 
-The facade is the sole importer of `@aws-sdk/client-s3` in your source tree per REQ-001. A project-side call site that reaches into the SDK directly is refused at author-side review.
+The facade is the sole importer of `@aws-sdk/client-s3` in your source tree per REQ-001. A project-side call site that reaches into the SDK directly is refused at the author-side check.
 
 ## Adapter choice per deploy target
 

package/blueprints/observability-essentials/CHANGELOG.md

@@ -1,5 +1,21 @@
+# Changelog
+
+## 2.1.6 - 2026-09-11
+
+metrics-endpoint (status-page) probe now supplies an x-request-id header on the GET /status call and asserts the fixture echoes it; AC-7104-2 and AC-7104-3 rows record the echoed request id as the identifier alongside the derived rendered-state and rendered-order lists. AC-7104-1 (configured-path clause) is de-claimed to conformanceOnly because the shipped probe-server hard-codes '/status' rather than accepting a paths.status option, so the configuration-provenance property is not observed here.
+
+## 2.1.5 - 2026-09-11
+
+readiness-probe AC-7102-1 anchor now observes the configuration-sourced path clause and the distinct-from-liveness clause. The probe boots the fixture with an explicit non-default readiness path (/readiness-cfg-v2) alongside a distinct liveness path (/live-cfg-v2), asserts the fixture serves the configured readiness path AND that the shipped default /ready returns 404 (default absent) AND that a GET at the configured liveness path returns the liveness body shape (no checks{}). The fixture probe-server accepts { paths: { liveness, readiness } } and refuses boot with PROBE_INTERFACE_PATHS_NOT_DISTINCT when the two are equal.
+
 # observability-essentials CHANGELOG
 
+## 2.1.4 - 2026-09-11
+
+Adds a contributions/probes/ pack (liveness-probe, readiness-probe, metrics-endpoint) with a fixture-side probe server under packages/rcf-lite/test/fixtures/probe-pack-observability-essentials/. Probes run against the fixture on Node 24 with a real TCP dependency the readiness probe controls. No account gate.
+
+Anchoring: liveness-probe anchors AC-7101-5 (three-request flow: HTTP 503 empty body on unhealthy; HTTP 503 repeat while predicate stays fail; HTTP 200 body.status='pass' after predicate restored). The healthy warm-up row de-claims with the limitation naming AC-7101-1 (path-from-configuration clause not observed). readiness-probe anchors AC-7102-1 (200 with body.status='pass' when every declared dependency passes; 503 with body.status='fail' when at least one fails, verified by closing a TCP dependency the probe controls). The checks-object shape and checkedAt rows de-claim with limitations naming AC-7103-1 (boot-time missing/malformed declaration refusal not observed) and AC-7103-2 (evaluation-budget bound is a probe-authored 5000 ms constant, not fixture-configured). metrics-endpoint asserts the /status page exact component set, states and rendered order per AC-7104-1. probe-utils normalisation and thrown-error rows carry an evidence object; the fallback anchorAcId is null.
+
 ## 2.1.2 - 2026-09-10
 
 Dimension-d single-definition-ownership cleanup on REQ-007: REQ description now references the JSON media-type header owned on TAC-801.responsibilities[1] rather than restating the header literal. Chain-consistency lint zero on pass 1 and pass 2.
@@ -8,14 +24,14 @@ Dimension-d single-definition-ownership cleanup on REQ-007: REQ description now
 
 - Register: neutral wording in shipped prose (no capability change).
 
-## 2.1.0 (hardening pass, 2026-09-09)
+## 2.1.0 (2026-09-09)
 
 - Adds `elicits[]` with four apply-time answers: `liveness-probe-path` (string, default /live; REQ-001), `readiness-probe-path` (string, default /ready; REQ-002), `declared-dependency-set` (string, comma-separated; REQ-003), and `notification-outcome-substrate` (enum sqlite/postgres/custom, default sqlite; REQ-006). Every option value is backed by a must-priority REQ description (section 7c criterion a).
 - Adds `deliveredBy` to every REQ (REQ-001/002/003/007/010 -> TAC-801/TAC-802 interface names; REQ-004/005 -> TAC-803; REQ-006 -> TAC-804; REQ-008 -> ADR-804; REQ-009 -> ADR-803). Closes 8 pass-2 lint findings; per-blueprint lint reports zero on pass 1 and pass 2.
-- Closes F-4 chain-contradiction specimen: AC-7107-3 previously compared v1.0.0 to future v1.x while the blueprint is v2. Rewrites the AC as a v2-baseline snapshot compatibility check against `blueprints/observability-essentials/assets/probe-samples/probe-response-baseline.v2.json` with stable-coded PROBE_BODY_SHAPE_DRIFT on rename or removal.
-- Closes F-1 (liveness self-check failure without AC coverage): adds AC-7101-5 asserting a response-capable in-process self-check predicate answers HTTP 503 with content-length 0 on fail and returns to 200 on pass; the AC is `template` because the predicate itself is project-owned.
-- Closes F-2 (boot-refuse ACs for dependency declaration): adds AC-7103-4 (deps missing -> READINESS_DEPS_MISSING), AC-7103-5 (duplicate name -> READINESS_DEPS_DUPLICATE, template on the declared set), AC-7103-6 (blank/malformed name -> READINESS_DEPS_MALFORMED).
-- Closes F-3 (durable outcome sink): adds AC-7106-4 asserting outcome records survive a sink restart (template on the elicited notification-outcome-substrate) and AC-7106-5 asserting a failed write signals NOTIFICATION_OUTCOME_WRITE_FAILED to the caller and does not fabricate a success record.
+- AC-7107-3 is a v2-baseline snapshot compatibility check against `blueprints/observability-essentials/assets/probe-samples/probe-response-baseline.v2.json` with stable-coded PROBE_BODY_SHAPE_DRIFT on rename or removal.
+- The liveness self-check failure without AC coverage gap is fixed: adds AC-7101-5 asserting a response-capable in-process self-check predicate answers HTTP 503 with content-length 0 on fail and returns to 200 on pass; the AC is `template` because the predicate itself is project-owned.
+- The boot-refuse ACs for dependency declaration gap is fixed: adds AC-7103-4 (deps missing -> READINESS_DEPS_MISSING), AC-7103-5 (duplicate name -> READINESS_DEPS_DUPLICATE, template on the declared set), AC-7103-6 (blank/malformed name -> READINESS_DEPS_MALFORMED).
+- The durable outcome sink gap is fixed: adds AC-7106-4 asserting outcome records survive a sink restart (template on the elicited notification-outcome-substrate) and AC-7106-5 asserting a failed write signals NOTIFICATION_OUTCOME_WRITE_FAILED to the caller and does not fabricate a success record.
 - Re-sweeps every existing AC's `disposition` per section 7b: ACs marked `template` (those whose text references elicited paths, project-declared dependencies, or the elicited substrate) with `templateFillIns` naming which values the applying agent sets; the remaining ACs stay `fixed`.
-- Review fix pass (F-2/F-3): adds `probeBodyShapeCompatibility` interface entry to TAC-802 that owns the cross-probe response body shape contract and names `PROBE_BODY_SHAPE_DRIFT`; updates AC-7107-3.ownerRef from ADR-803.decision.probeBodyShape (which the decision text did not carry) to TAC-802.interfaces.probeBodyShapeCompatibility; moves the v2 baseline snapshot from `packages/rcf-lite/test/blueprint/` to `blueprints/observability-essentials/assets/probe-samples/probe-response-baseline.v2.json` so its placement matches its documentation-fixture nature (no suite test read it in the previous location).
-- Review fix pass (F-7): extends REQ-006 description with a runtime clause per substrate option (`sqlite`, `postgres`, `custom`), literally named and each backed as the accepted values the notification-outcome-substrate elicit resolves at boot (AC-7106-4 exercises the restart path across substrates; AC-7106-5 exercises the failed-write path).
+- adds `probeBodyShapeCompatibility` interface entry to TAC-802 that owns the cross-probe response body shape contract and names `PROBE_BODY_SHAPE_DRIFT`; updates AC-7107-3.ownerRef from ADR-803.decision.probeBodyShape (which the decision text did not carry) to TAC-802.interfaces.probeBodyShapeCompatibility; moves the v2 baseline snapshot from `packages/rcf-lite/test/blueprint/` to `blueprints/observability-essentials/assets/probe-samples/probe-response-baseline.v2.json` so its placement matches its documentation-fixture nature (no suite test read it in the previous location).
+- extends REQ-006 description with a runtime clause per substrate option (`sqlite`, `postgres`, `custom`), literally named and each backed as the accepted values the notification-outcome-substrate elicit resolves at boot (AC-7106-4 exercises the restart path across substrates; AC-7106-5 exercises the failed-write path).

package/blueprints/observability-essentials/README.md

@@ -31,9 +31,9 @@ The doc set is contributions (copied into the project tree by `rcf define bluepr
 
 ## What it contributes, and what it deliberately does not
 
-Contributed kinds: REQ, US (with inline ACs), TAC, ADR. Adherence is expressed as ACs; the blueprint ships no test files (ratified decision 5) and no code.
+Contributed kinds: REQ, US (with inline ACs), TAC, ADR. Adherence is expressed as ACs; the blueprint ships no test files (shipped policy 5) and no code.
 
-No FBS contributions, as a matter of principle (ratified policy 2026-08-19): FBSs are the work of the implementing agent, not the blueprint; project constraints have to be applied at the time of creation. The blueprint contributes the WHAT (the liveness probe contract, the readiness probe contract with its dependency-set declaration and cached-state evaluator, the public status page contract with its declared component list and stable notice fields, the notification outcome sink contract with its recordOutcome and queryByRecipient verbs); the implementing agent derives the HOW-tasks (FBS) in the host project, where the ACs contributed here get picked up by the project's own build sequencing.
+No FBS contributions, as a matter of principle (policy): FBSs are the work of the implementing agent, not the blueprint; project constraints have to be applied at the time of creation. The blueprint contributes the WHAT (the liveness probe contract, the readiness probe contract with its dependency-set declaration and cached-state evaluator, the public status page contract with its declared component list and stable notice fields, the notification outcome sink contract with its recordOutcome and queryByRecipient verbs); the implementing agent derives the HOW-tasks (FBS) in the host project, where the ACs contributed here get picked up by the project's own build sequencing.
 
 Deliberately not contributed: historical uptime charts and rolling reliability numbers on the status page (out of scope at v1.0.0; see 'Known mechanism-reach gaps' below and the guide 'when it does not fit'); a metrics-export surface (Prometheus scrape endpoints, StatsD emission, OpenTelemetry metrics); a distributed-tracing surface (span emission, propagation, sampling); a log-shipping surface (the application-api-rest blueprint's `logging` topic already governs the wire-log shape; this blueprint neither extends nor conflicts with it); an authenticated operator dashboard for granular internal state (the operator gets granular state through the readiness probe body and through project-authored authenticated surfaces, not through this blueprint); the durable substrate for the notification outcome sink (project-owned; the persistence-data-sqlite blueprint is the natural compose partner). An operator-panel-style authenticated drift surface is deliberately outside this blueprint's scope: `operatorPanel` is claimed by the hello-panel walkthrough exemplar and this blueprint does not overlap it.
 

package/blueprints/observability-essentials/assets/probe-samples/probe-response-baseline.v2.json

@@ -1,5 +1,5 @@
 {
-  "// Baseline documented for observability-essentials AC-7107-3": "Hardening pass (2026-09-09): captures the v2 baseline shape of the /live and /ready probe response bodies so a release-time compatibility check can compare a candidate against the current v2 snapshot. A candidate that renames or removes a field named here fails with PROBE_BODY_SHAPE_DRIFT; additions are allowed.",
+  "// Baseline documented for observability-essentials AC-7107-3": "captures the v2 baseline shape of the /live and /ready probe response bodies so a release-time compatibility check can compare a candidate against the current v2 snapshot. A candidate that renames or removes a field named here fails with PROBE_BODY_SHAPE_DRIFT; additions are allowed.",
   "live": {
     "status": "pass",
     "checkedAt": "ISO-8601 timestamp string"

package/blueprints/observability-essentials/blueprint.json

@@ -1,6 +1,6 @@
 {
   "slug": "observability-essentials",
-  "version": "2.1.2",
+  "version": "2.1.6",
   "category": "observability",
   "elicits": [
     {
@@ -181,5 +181,6 @@
       "kind": "adr",
       "path": "adrs/adr-805-observability-essentials-notification-outcome-model.json"
     }
-  ]
+  ],
+  "updatedAt": "2026-09-11"
 }