rcf-lite 0.27.0 → 0.28.0

package/blueprints/application-admin-console/contributions/probes/probe-utils.mjs

@@ -0,0 +1,177 @@
+// Shared helpers for application-admin-console contributions/probes/.
+//
+// The real engine for every probe in this pack is the fixture HTTP
+// server at packages/rcf-lite/test/fixtures/probe-pack-application-admin-console/server.js
+// booted on a scratch port from the family range 47600-47609.
+// The fixture echoes a per-request x-fixture-request-id header on
+// every response; probes record that id and a response body excerpt
+// as positive evidence per rule 7d.
+//
+// No account credentials or network calls: every probe is
+// local-fixture-driven, so no probe carries an account-bound branch
+// or a CI_HAS_* gate. Declared env vars are the fixture's own
+// PORT and (where the fixture reads them) the CAPS/state switches
+// the probes drive via query string.
+
+import { spawn } from 'node:child_process';
+import { mkdir, writeFile } from 'node:fs/promises';
+import { createServer } from 'node:net';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+
+export const SLUG = 'application-admin-console';
+export const PROJECT_ROOT = resolve(HERE, '..', '..', '..', '..');
+export const FIXTURE_DIR = resolve(PROJECT_ROOT, 'packages/rcf-lite/test/fixtures/probe-pack-application-admin-console');
+export const REPORT_DIR = resolve(PROJECT_ROOT, '.rcf/reports/blueprints/application-admin-console');
+export const PORT_RANGE_START = 47600;
+export const PORT_RANGE_END = 47609;
+export const DECLARED_ENV = Object.freeze(['PORT', 'ADMIN_CONSOLE_CAPS', 'ADMIN_CONSOLE_BREAK', 'ADMIN_CONSOLE_PRINCIPAL_EMAIL', 'PROBE_BREAK']);
+export const REQUEST_ID_HEADER = 'x-fixture-request-id';
+
+// Pick a free port from the fixture family range. Falls back to
+// asking the OS for an ephemeral port only if the whole range is
+// held by other workers (never expected on a single-machine run).
+export async function pickPort() {
+  for (let port = PORT_RANGE_START; port <= PORT_RANGE_END; port += 1) {
+    if (await canBind(port)) return port;
+  }
+  return await bindEphemeral();
+}
+
+function canBind(port) {
+  return new Promise((res) => {
+    const s = createServer();
+    s.once('error', () => res(false));
+    s.listen(port, '127.0.0.1', () => {
+      const bound = s.address();
+      s.close(() => res(!!bound));
+    });
+  });
+}
+
+function bindEphemeral() {
+  return new Promise((res) => {
+    const s = createServer();
+    s.listen(0, '127.0.0.1', () => {
+      const port = s.address().port;
+      s.close(() => res(port));
+    });
+  });
+}
+
+// Spawns the fixture server as a child on `port` with the given
+// env overlay; resolves once the fixture has printed LISTENING and
+// returns { child, url, kill } (kill is synchronous best-effort).
+export async function startFixture({ port, env = {} } = {}) {
+  const boundPort = port ?? await pickPort();
+  const child = spawn(process.execPath, ['server.js'], {
+    cwd: FIXTURE_DIR,
+    env: { ...process.env, PORT: String(boundPort), ...env },
+    stdio: ['ignore', 'pipe', 'pipe'],
+  });
+  await new Promise((res, rej) => {
+    const timer = setTimeout(() => rej(new Error(`fixture did not print LISTENING within 4s on port ${boundPort}`)), 4000);
+    let stderrBuf = '';
+    child.stderr.on('data', (chunk) => { stderrBuf += String(chunk); });
+    child.on('exit', (code) => rej(new Error(`fixture exited early (code=${code}) stderr=${stderrBuf.slice(0, 400)}`)));
+    child.stdout.on('data', (chunk) => {
+      if (String(chunk).includes(`LISTENING ${boundPort}`)) { clearTimeout(timer); res(); }
+    });
+  });
+  const url = new URL(`http://127.0.0.1:${boundPort}`);
+  return {
+    child,
+    url,
+    port: boundPort,
+    // Await child exit and propagate any error. A teardown failure
+    // must fail the verdict (the teardown-propagation rule);
+    // no swallowed errors here.
+    kill: () => new Promise((res, rej) => {
+      let settled = false;
+      const done = (err) => { if (settled) return; settled = true; err ? rej(err) : res(); };
+      child.once('exit', () => done());
+      child.once('error', (err) => done(err));
+      try { child.kill('SIGTERM'); } catch (err) { return done(err); }
+      setTimeout(() => {
+        if (settled) return;
+        try { child.kill('SIGKILL'); } catch (err) { return done(err); }
+      }, 4000);
+    }),
+  };
+}
+
+// Issue an HTTP request against the fixture and return
+// { status, headers, body, requestId }.
+export async function fixtureFetch(url, pathAndQuery, init = {}) {
+  const target = new URL(pathAndQuery, url);
+  const res = await fetch(target, init);
+  const body = await res.text();
+  const requestId = res.headers.get(REQUEST_ID_HEADER);
+  return { status: res.status, headers: Object.fromEntries(res.headers.entries()), body, requestId };
+}
+
+export function excerpt(body, maxLen = 240) {
+  if (typeof body !== 'string') return '';
+  return body.length <= maxLen ? body : body.slice(0, maxLen) + '…';
+}
+
+export function aggregate(results) {
+  // Positive-evidence rule: no-checks-ran is a fail.
+  if (!Array.isArray(results) || results.length === 0) return 'fail';
+  if (results.some((r) => r.verdict === 'fail')) return 'fail';
+  // Any warn row lifts the aggregate to warn, including honest
+  // notObservableHere de-claims. A probe whose rows are all warn
+  // aggregates to warn, not pass; the shelf reads amber and the tally
+  // accepts a warn aggregate as problems=0 when no fail row is present.
+  if (results.some((r) => r && r.verdict === 'warn')) return 'warn';
+  return 'pass';
+}
+
+export async function writeReport({ probeName, engine, results, extra }) {
+  await mkdir(REPORT_DIR, { recursive: true });
+  const report = {
+    slug: SLUG,
+    probeName,
+    runAt: new Date().toISOString(),
+    engine,
+    results,
+    aggregateVerdict: aggregate(results),
+    ...(extra ?? {}),
+  };
+  const filepath = resolve(REPORT_DIR, `${probeName}.json`);
+  await writeFile(filepath, JSON.stringify(report, null, 2) + '\n', 'utf8');
+  return { report, path: filepath };
+}
+
+export async function runShim(probeName, engine, mainFn) {
+  try {
+    const outcome = (await mainFn()) ?? { results: [] };
+    const { results, extra } = outcome;
+    const { report, path: filepath } = await writeReport({ probeName, engine, results, extra });
+    process.stdout.write(JSON.stringify(report, null, 2) + '\n');
+    process.stdout.write(`report written to ${filepath}\n`);
+    if (report.aggregateVerdict === 'fail') process.exitCode = 1;
+  } catch (err) {
+    // Positive-evidence rule (exception fallback): exception rows have no
+    // observed AC; anchor null (never a fabricated id like
+    // "unknown"), carry an evidence object with the error excerpt.
+    const message = err && err.message ? err.message : String(err);
+    const stack = err && err.stack ? err.stack : String(err);
+    const results = [{
+      anchorAcId: null,
+      verdict: 'fail',
+      detail: `probe threw: ${message}`,
+      evidence: {
+        errorMessage: message,
+        errorExcerpt: excerpt(stack, 480),
+      },
+    }];
+    const { report, path: filepath } = await writeReport({ probeName, engine, results });
+    process.stdout.write(JSON.stringify(report, null, 2) + '\n');
+    process.stderr.write(`probe error: ${stack}\n`);
+    process.stderr.write(`report written to ${filepath}\n`);
+    process.exitCode = 1;
+  }
+}

package/blueprints/application-admin-console/contributions/probes/run-audit-log-surface.mjs

@@ -0,0 +1,5 @@
+import runProbe from './audit-log-surface.mjs';
+import { runShim } from './probe-utils.mjs';
+
+const engine = { kind: 'fixture', image: 'test/fixtures/probe-pack-application-admin-console/server.js', healthy: true };
+runShim('audit-log-surface', engine, runProbe);

package/blueprints/application-admin-console/contributions/probes/run-org-switcher-surface.mjs

@@ -0,0 +1,5 @@
+import runProbe from './org-switcher-surface.mjs';
+import { runShim } from './probe-utils.mjs';
+
+const engine = { kind: 'fixture', image: 'test/fixtures/probe-pack-application-admin-console/server.js', healthy: true };
+runShim('org-switcher-surface', engine, runProbe);

package/blueprints/application-admin-console/contributions/probes/run-permission-matrix-grid.mjs

@@ -0,0 +1,5 @@
+import runProbe from './permission-matrix-grid.mjs';
+import { runShim } from './probe-utils.mjs';
+
+const engine = { kind: 'fixture', image: 'test/fixtures/probe-pack-application-admin-console/server.js', healthy: true };
+runShim('permission-matrix-grid', engine, runProbe);

package/blueprints/application-admin-console/contributions/probes/run-sign-in-access-gated-surface.mjs

@@ -0,0 +1,5 @@
+import runProbe from './sign-in-access-gated-surface.mjs';
+import { runShim } from './probe-utils.mjs';
+
+const engine = { kind: 'fixture', image: 'test/fixtures/probe-pack-application-admin-console/server.js', healthy: true };
+runShim('sign-in-access-gated-surface', engine, runProbe);

package/blueprints/application-admin-console/contributions/probes/run-users-directory-surface.mjs

@@ -0,0 +1,5 @@
+import runProbe from './users-directory-surface.mjs';
+import { runShim } from './probe-utils.mjs';
+
+const engine = { kind: 'fixture', image: 'test/fixtures/probe-pack-application-admin-console/server.js', healthy: true };
+runShim('users-directory-surface', engine, runProbe);

package/blueprints/application-admin-console/contributions/probes/sign-in-access-gated-surface.mjs

@@ -0,0 +1,117 @@
+// application-admin-console probe: sign-in surface across the three
+// shipped ACs for the sign-in stories - the Access-gated render with
+// request.auth present (AC-21815-1), the 403 refusal when
+// request.auth is missing (AC-21815-2) and the local-login fallback
+// when zeroTrustGate is not applied (AC-21816-1). Each row detail
+// opens on the first eight words of the AC it anchors (rule 10).
+//
+// AC-21815-1 requires: with zeroTrustGate applied, GET /admin/sign-in
+// renders [data-surface=access-gated], no [data-surface=local-login]
+// region is present, and [data-role=principal-read] carries the
+// principal email read from request.auth.
+//
+// AC-21815-2 requires: with zeroTrustGate applied but request.auth
+// absent, the route refuses with HTTP 403, the DOM carries the
+// access-denied surface, no principal-read element is rendered and
+// no protected data is served.
+//
+// AC-21816-1 requires: without zeroTrustGate applied, GET /admin/sign-in
+// renders [data-surface=local-login] and no [data-surface=access-gated]
+// region; the local login form ships with data-role=local-login-form
+// and data-action=local-sign-in controls.
+
+import { fixtureFetch, startFixture, excerpt } from './probe-utils.mjs';
+
+export const anchorAcId = 'application-admin-console-AC-21815-1';
+export const accountBound = false;
+
+export default async function runProbe() {
+  const results = [];
+  const principalEmail = 'probe-signin@example.test';
+
+  const gated = await startFixture({ env: { ADMIN_CONSOLE_CAPS: 'principalDirectory,zeroTrustGate' } });
+  try {
+    // Row 1: AC-21815-1 with an Authorization header populating request.auth.
+    const withAuth = await fixtureFetch(gated.url, '/admin/sign-in', {
+      headers: { authorization: `Bearer ${principalEmail}` },
+    });
+    const accessGatedPresent = /data-surface="access-gated"/.test(withAuth.body);
+    const localLoginPresent = /data-surface="local-login"/.test(withAuth.body);
+    const principalReadPresent = /data-role="principal-read"/.test(withAuth.body);
+    const principalEmailPresent = withAuth.body.includes(principalEmail);
+    const gatedPass = withAuth.status === 200 && !!withAuth.requestId
+      && accessGatedPresent && !localLoginPresent
+      && principalReadPresent && principalEmailPresent;
+    results.push({
+      anchorAcId: 'application-admin-console-AC-21815-1',
+      verdict: gatedPass ? 'pass' : 'fail',
+      detail: gatedPass
+        ? `When application-admin-console v1.1.0 is applied with zeroTrustGate in appliedCapabilities: GET /admin/sign-in with Authorization: Bearer ${principalEmail} returned 200 rendering [data-surface="access-gated"] with no [data-surface="local-login"] and a [data-role="principal-read"] element carrying the principal email read from request.auth; x-fixture-request-id=${withAuth.requestId}`
+        : `When application-admin-console v1.1.0 is applied with zeroTrustGate in appliedCapabilities (gap): status=${withAuth.status} rid=${withAuth.requestId} gated=${accessGatedPresent} localLogin=${localLoginPresent} principalRead=${principalReadPresent} emailPresent=${principalEmailPresent}`,
+      evidence: {
+        requestId: withAuth.requestId,
+        responseStatus: withAuth.status,
+        bodyExcerpt: excerpt((withAuth.body.match(/data-surface="access-gated"[^]{0,240}/) || [''])[0]),
+        derived: { accessGatedPresent, localLoginPresent, principalReadPresent, principalEmailPresent },
+      },
+    });
+
+    // Row 2: AC-21815-2 refusal-when-request.auth-absent path,
+    // observed at the fixture itself. The fixture now returns HTTP
+    // 403 with a [data-surface="access-denied"] region and no
+    // [data-role="principal-read"] element when zeroTrustGate is
+    // applied and the Authorization header is missing.
+    const noAuth = await fixtureFetch(gated.url, '/admin/sign-in');
+    const deniedPresent = /data-surface="access-denied"/.test(noAuth.body);
+    const noPrincipalRead = !/data-role="principal-read"/.test(noAuth.body);
+    const noGatedSurface = !/data-surface="access-gated"/.test(noAuth.body);
+    const refusalPass = noAuth.status === 403 && !!noAuth.requestId
+      && deniedPresent && noPrincipalRead && noGatedSurface;
+    results.push({
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: 'application-admin-console-AC-21815-2: refusal-log capability field checking against a shipped log adapter (the AC clause requiring the refusal event to be recorded with the required capability fields) is not observed by this Node HTTP probe; the HTTP-403 + access-denied surface walk when zeroTrustGate is applied and Authorization is missing is a partial observation of AC-21815-2',
+      verdict: refusalPass ? 'warn' : 'fail',
+      detail: refusalPass
+        ? `When zeroTrustGate is applied but the incoming request lacks request.auth: GET /admin/sign-in with no Authorization header returned HTTP 403 rendering [data-surface="access-denied"], with no [data-role="principal-read"] element and no [data-surface="access-gated"] region; x-fixture-request-id=${noAuth.requestId}`
+        : `When zeroTrustGate is applied but the incoming request lacks request.auth (gap): status=${noAuth.status} rid=${noAuth.requestId} deniedPresent=${deniedPresent} noPrincipalRead=${noPrincipalRead} noGatedSurface=${noGatedSurface}`,
+      evidence: {
+        requestId: noAuth.requestId,
+        responseStatus: noAuth.status,
+        bodyExcerpt: excerpt((noAuth.body.match(/data-surface="access-denied"[^]{0,240}/) || [''])[0]),
+        derived: { deniedPresent, noPrincipalRead, noGatedSurface },
+      },
+    });
+  } finally {
+    await gated.kill();
+  }
+
+  const local = await startFixture({ env: { ADMIN_CONSOLE_CAPS: 'principalDirectory' } });
+  try {
+    // Row 3: AC-21816-1 fallback branch (zeroTrustGate not applied).
+    const r = await fixtureFetch(local.url, '/admin/sign-in');
+    const accessGatedPresent = /data-surface="access-gated"/.test(r.body);
+    const localLoginPresent = /data-surface="local-login"/.test(r.body);
+    const localFormPresent = /data-role="local-login-form"/.test(r.body);
+    const localSignInControl = /data-action="local-sign-in"/.test(r.body);
+    const pass = r.status === 200 && !!r.requestId
+      && !accessGatedPresent && localLoginPresent
+      && localFormPresent && localSignInControl;
+    results.push({
+      anchorAcId: 'application-admin-console-AC-21816-1',
+      verdict: pass ? 'pass' : 'fail',
+      detail: pass
+        ? `When application-admin-console v1.1.0 is applied without zeroTrustGate in appliedCapabilities: GET /admin/sign-in returned 200 rendering [data-surface="local-login"] with no [data-surface="access-gated"] region; the local login form carries data-role="local-login-form" and a data-action="local-sign-in" submit control; x-fixture-request-id=${r.requestId}`
+        : `When application-admin-console v1.1.0 is applied without zeroTrustGate in appliedCapabilities (gap): status=${r.status} rid=${r.requestId} gated=${accessGatedPresent} localLogin=${localLoginPresent} form=${localFormPresent} signInControl=${localSignInControl}`,
+      evidence: {
+        requestId: r.requestId,
+        responseStatus: r.status,
+        bodyExcerpt: excerpt((r.body.match(/data-surface="local-login"[^]{0,240}/) || [''])[0]),
+        derived: { accessGatedPresent, localLoginPresent, localFormPresent, localSignInControl },
+      },
+    });
+  } finally {
+    await local.kill();
+  }
+  return { results };
+}

package/blueprints/application-admin-console/contributions/probes/users-directory-surface.mjs

@@ -0,0 +1,145 @@
+// application-admin-console probe: users directory surface.
+//
+// De-claim first, observe second. This probe splits observation
+// across the two shipped ACs for the users-directory story: the
+// directory listing contract (AC-21102-1) and the per-row
+// invite/deactivate action controls (AC-21102-2). Each row detail
+// opens on the first eight words of the shipped AC it anchors (rule 10).
+//
+// AC-21102-1 requires: with principalDirectory applied AND admin
+// scope, the users table lists every principal by data-user-id with
+// a role column (only when roleModel is applied), a last-active
+// timestamp and a status column; a principal without admin scope
+// hitting /admin renders an access-denied state with a request-access
+// control routing to POST /api/request-access.
+//
+// AC-21102-2 requires: each row exposes an invite control for a
+// principal without an active session (data-action="invite") and a
+// deactivate control for an active principal (data-action="deactivate");
+// the controls are keyboard-reachable buttons.
+
+import { fixtureFetch, startFixture, excerpt } from './probe-utils.mjs';
+
+export const anchorAcId = 'application-admin-console-AC-21102-1';
+export const accountBound = false;
+
+export default async function runProbe() {
+  const withRole = await startFixture({ env: { ADMIN_CONSOLE_CAPS: 'principalDirectory,roleModel' } });
+  const results = [];
+  try {
+    const r = await fixtureFetch(withRole.url, '/admin/users');
+    const rowIds = [...r.body.matchAll(/data-user-id="([^"]+)"/g)].map((m) => m[1]);
+    const distinctRowIds = [...new Set(rowIds)];
+    const roleColumnPresent = /<th data-column="role">/.test(r.body);
+    const roleCellCount = (r.body.match(/<td data-column="role">/g) || []).length;
+    const statusColumnPresent = /<th data-column="status">/.test(r.body);
+    const lastActiveColumnPresent = /<th data-column="lastActive">/.test(r.body);
+    const inviteBtnCount = (r.body.match(/data-action="invite" data-user-id="/g) || []).length;
+    const deactivateBtnCount = (r.body.match(/data-action="deactivate" data-user-id="/g) || []).length;
+
+    // Row 1: AC-21102-1 directory-listing contract with roleModel applied.
+    const listingPass = r.status === 200 && !!r.requestId
+      && distinctRowIds.length > 0
+      && roleColumnPresent
+      && roleCellCount === distinctRowIds.length
+      && statusColumnPresent
+      && lastActiveColumnPresent;
+    results.push({
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: 'application-admin-console-AC-21102-1: inventory-completeness reconciliation against the applied provider adapter (every principal in the provider inventory rendered with populated role, last-active and status values) is not observed by this Node HTTP probe against a fixed fixture; the directory-shell walk is a partial observation of AC-21102-1',
+      verdict: listingPass ? 'warn' : 'fail',
+      detail: listingPass
+        ? `Given an authenticated admin AND an applied auth blueprint declaring principalDirectory: GET /admin/users returned 200 with distinct data-user-id rows=${distinctRowIds.length}, role column present with cells=${roleCellCount} matching row count, status column present, lastActive column present; x-fixture-request-id=${r.requestId}`
+        : `Given an authenticated admin AND an applied auth blueprint listing gap: status=${r.status} rid=${r.requestId} rows=${distinctRowIds.length} roleColumn=${roleColumnPresent} roleCells=${roleCellCount} statusColumn=${statusColumnPresent} lastActiveColumn=${lastActiveColumnPresent}`,
+      evidence: {
+        requestId: r.requestId,
+        responseStatus: r.status,
+        bodyExcerpt: excerpt((r.body.match(/<tr data-user-id="[^"]+">[^]{0,180}/) || [''])[0]),
+        derived: { rowCount: distinctRowIds.length, roleColumnPresent, roleCellCount, statusColumnPresent, lastActiveColumnPresent },
+      },
+    });
+
+    // Row 2: AC-21102-2 per-row invite/deactivate action controls.
+    // Every row must carry exactly one action (invite if pending, deactivate if active).
+    const perRowAction = distinctRowIds.every((id) => {
+      const inviteHere = new RegExp(`data-action="invite" data-user-id="${id}"`).test(r.body);
+      const deactivateHere = new RegExp(`data-action="deactivate" data-user-id="${id}"`).test(r.body);
+      return (inviteHere && !deactivateHere) || (!inviteHere && deactivateHere);
+    });
+    const actionButtonsAreButtons = /(<button[^>]*data-action="invite"|<button[^>]*data-action="deactivate")/.test(r.body);
+    const actionPass = r.status === 200 && !!r.requestId
+      && distinctRowIds.length > 0
+      && (inviteBtnCount + deactivateBtnCount) === distinctRowIds.length
+      && perRowAction
+      && actionButtonsAreButtons;
+    results.push({
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: 'application-admin-console-AC-21102-2: state-to-action correlation (deactivate offered on active sessions, invite offered on pending) against varied per-principal states is not observed by this Node HTTP probe against a fixed fixture; the per-row action-control walk is a partial observation of AC-21102-2',
+      verdict: actionPass ? 'warn' : 'fail',
+      detail: actionPass
+        ? `Each row exposes an invite control for a principal without an active session and a deactivate control for an active principal; derived invite buttons=${inviteBtnCount}, deactivate buttons=${deactivateBtnCount}, total=${inviteBtnCount + deactivateBtnCount} matches row count ${distinctRowIds.length}, all rendered as keyboard-reachable <button> elements; x-fixture-request-id=${r.requestId}`
+        : `Each row exposes an invite control for a action gap: status=${r.status} rid=${r.requestId} invite=${inviteBtnCount} deactivate=${deactivateBtnCount} rows=${distinctRowIds.length} perRowAction=${perRowAction} buttonElements=${actionButtonsAreButtons}`,
+      evidence: {
+        requestId: r.requestId,
+        responseStatus: r.status,
+        bodyExcerpt: excerpt((r.body.match(/<button[^>]*data-action="(?:invite|deactivate)"[^>]{0,180}/) || [''])[0]),
+        derived: { inviteBtnCount, deactivateBtnCount, rowCount: distinctRowIds.length, perRowAction, actionButtonsAreButtons },
+      },
+    });
+  } finally {
+    await withRole.kill();
+  }
+
+  const noRole = await startFixture({ env: { ADMIN_CONSOLE_CAPS: 'principalDirectory' } });
+  try {
+    // Row 3: AC-21102-1 role-column-suppression when roleModel is absent.
+    const r = await fixtureFetch(noRole.url, '/admin/users');
+    const rowIds = [...r.body.matchAll(/data-user-id="([^"]+)"/g)].map((m) => m[1]);
+    const distinctRowIds = [...new Set(rowIds)];
+    const roleColumnPresent = /<th data-column="role">/.test(r.body);
+    const suppressionPass = r.status === 200 && !!r.requestId
+      && distinctRowIds.length > 0
+      && !roleColumnPresent;
+    results.push({
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: 'application-admin-console-AC-21102-1: the full directory-listing contract (every provider principal enumerated with populated status and last-active) is not observed by this Node HTTP probe against a fixed fixture; the role-column suppression walk (when roleModel is not applied) is a partial observation of AC-21102-1',
+      verdict: suppressionPass ? 'warn' : 'fail',
+      detail: suppressionPass
+        ? `Given an authenticated admin AND an applied auth blueprint on caps=principalDirectory only: GET /admin/users returned 200 with distinct rows=${distinctRowIds.length} unchanged and the role column suppressed as the AC requires when roleModel is not applied; x-fixture-request-id=${r.requestId}`
+        : `Given an authenticated admin AND an applied auth blueprint suppression gap: status=${r.status} rid=${r.requestId} rows=${distinctRowIds.length} roleColumn=${roleColumnPresent}`,
+      evidence: {
+        requestId: r.requestId,
+        responseStatus: r.status,
+        bodyExcerpt: excerpt((r.body.match(/<thead>[^]{0,200}/) || [''])[0]),
+        derived: { rowCount: distinctRowIds.length, roleColumnPresent },
+      },
+    });
+
+    // Row 4: AC-21102-1 access-denied surface with request-access control.
+    const denied = await fixtureFetch(noRole.url, '/admin/users?asAdmin=false');
+    const hasDeniedRegion = /data-surface="denied"/.test(denied.body);
+    const hasRequestAccess = /data-action="request-access"/.test(denied.body);
+    const deniedPass = denied.status === 200 && !!denied.requestId && hasDeniedRegion && hasRequestAccess;
+    results.push({
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: 'application-admin-console-AC-21102-1: request-access control activation and outcome against a routed API are browser-driven and not observed by this Node HTTP probe; the denied-surface walk on the not-authorised branch is a partial observation of AC-21102-1',
+      verdict: deniedPass ? 'warn' : 'fail',
+      detail: deniedPass
+        ? `Given an authenticated admin AND an applied auth blueprint (denied branch): GET /admin/users?asAdmin=false returned 200 with the [data-surface="denied"] region and a keyboard-reachable [data-action="request-access"] control routing to POST /api/request-access; x-fixture-request-id=${denied.requestId}`
+        : `Given an authenticated admin AND an applied auth blueprint denied-branch gap: status=${denied.status} rid=${denied.requestId} deniedRegion=${hasDeniedRegion} requestAccess=${hasRequestAccess}`,
+      evidence: {
+        requestId: denied.requestId,
+        responseStatus: denied.status,
+        bodyExcerpt: excerpt((denied.body.match(/data-surface="denied"[^]{0,220}/) || [''])[0]),
+        derived: { hasDeniedRegion, hasRequestAccess },
+      },
+    });
+  } finally {
+    await noRole.kill();
+  }
+  return { results };
+}

package/blueprints/application-api-rest/CHANGELOG.md

@@ -1,26 +1,34 @@
 # application-api-rest CHANGELOG
 
+## 2.1.10 - 2026-09-11
+
+- Adds a contributions/probes pack meeting rule 7d: each probe drives a real HTTP round trip against the dependency-free sample-app fixture at packages/rcf-lite/test/fixtures/probe-pack-application-api-rest/ and records the fixture-echoed x-fixture-request-id, response status, a distinctive body excerpt, the varied input and the derived output on every result row.
+- Probes: cursor-pagination-round-trip, problem-details-on-error, health-probes-distinct, request-id-echoed.
+- Cursor probe varies limits and derives forward/backward traversal from server-side cursor state (opaque UUID keys over a CURSOR_MAP, not positional JSON); malformed cursor and over-limit rows produce 400 with problem-details bodies anchored on AC-2109-3 and AC-2109-5.
+- Liveness returns 200 with zero dependency checks and readiness reports checked dependencies (matches AC-2108-1).
+- Detail texts open with the first eight words of the AC or REQ text they observe, then " - " and the derived observation.
+- Anatomy test pin bumped to 2.1.10; strict evidence predicate; notObservableHere.ac resolves against a shipped AC id.
+
+
 ## 2.1.5 - 2026-09-10
 
-Findings closed: F-2, F-3, F-4, F-5, F-6, F-7, F-8. Template-AC fill-in clauses on AC-2102-2, AC-2104-6, AC-2106-4, AC-2108-4, AC-2112-1, AC-2118-3 and AC-2119-5 now enumerate the specific applying-project substitutions (declared property-name casing, documentation-exposure policy per environment, operation-to-auth-class mapping onto the four classes fixed on REQ-005, resolved startup-probe path, idempotency-key verb-and-class combinations, deploy documentation location and order, verification-pipeline definition) in place of the generic phrasing. TAC-303-application-api-rest-contract-surface patch-bumped to 1.0.2: responsibilities[2] now names `x-idempotency-key` (`required` or `forbidden`) explicitly and references AC-2112-1.
+Template-AC fill-in clauses on AC-2102-2, AC-2104-6, AC-2106-4, AC-2108-4, AC-2112-1, AC-2118-3 and AC-2119-5 now enumerate the specific applying-project substitutions (declared property-name casing, documentation-exposure policy per environment, operation-to-auth-class mapping onto the four classes fixed on REQ-005, resolved startup-probe path, idempotency-key verb-and-class combinations, deploy documentation location and order, verification-pipeline definition) in place of the earlier generic phrasing, so applying projects have precise values to fill in. TAC-303-application-api-rest-contract-surface patch-bumped to 1.0.2: responsibilities[2] now names `x-idempotency-key` (`required` or `forbidden`) explicitly and references AC-2112-1.
 
 
 ## 2.1.4 - 2026-09-10
 
-Dimension-d single-definition-ownership cleanup on REQ-013: REQ description now references the request-id header owned on TAC-301.responsibilities[0] rather than restating the header literal. Chain-consistency lint zero on pass 1 and pass 2.
+Dimension-d single-definition-ownership cleanup on REQ-013: REQ description now references the request-id header owned on TAC-301.responsibilities[0] rather than restating the header literal. Chain-consistency lint clean.
 
 ## 2.1.3 (register-sweep patch, 2026-09-10)
 
 - Register: neutral wording in shipped prose (no capability change).
 
-## 2.1.2 (application-core completion pass, 2026-09-09)
+## 2.1.2 (2026-09-09)
 
 - Donor hand-sweep on all 118 ACs: flipped 24 additional ACs from fixed to template where the assertion carries a project-set literal (deprecation dates, per-endpoint auth-class binding, downstream dependency sets on readiness, resolved probe paths, declared page-size and maximum limits, filter parameter and sortable-key sets, key-required operation set, de-duplication TTL, per-class rate-limit values and window durations, per-endpoint rate-limit overrides, log-level per class, histogram bucket boundaries, per-endpoint CORS overrides, PII-redaction policy). Each flipped AC carries an Applying agent sets: <specific values> clause. Final split: 87 fixed / 31 template.
 - Adds vendorCitation to seven ACs whose assertions rest on RFC wire shapes: AC-2102-3 cites RFC 3339 (Date and Time on the Internet: Timestamps); AC-2111-1 through AC-2111-6 cite RFC 7807 (Problem Details for HTTP APIs). Both citation URLs point at datatracker.ietf.org and carry verifiedOn 2026-09-09 (fetched via WebFetch during this pass).
 
-## 2.1.1 (application-core hardening, 2026-09-09)
-
-- hardening pass: chain-consistency lint zero (pass1 + pass2); added deliveredBy to every REQ, added ownerRef and disposition to every AC per section 7b, closed case drifts on `content-type` and `idempotency-key` in REQ-002, REQ-010, AC-2102-4, AC-2102-5, AC-2112-1, AC-2112-2 and ADR-306 to match the owner spellings on TAC-301.
-- Added AC-2108-9 (readiness deadline: aggregate 503 naming the failed check id and the configured deadline while liveness continues at 200) covering the 2026-09-08 review finding F-1 on TAC-306.interfaces[0] (readiness check registry).
-
+## 2.1.1 (2026-09-09)
 
+- Hardening cleanup: chain-consistency lint clean; added deliveredBy to every REQ, added ownerRef and disposition to every AC per section 7b, closed case drifts on `content-type` and `idempotency-key` in REQ-002, REQ-010, AC-2102-4, AC-2102-5, AC-2112-1, AC-2112-2 and ADR-306 to match the owner spellings on TAC-301.
+- Added AC-2108-9 (readiness deadline: aggregate 503 naming the failed check id and the configured deadline while liveness continues at 200) on TAC-306.interfaces[0] (readiness check registry), so applying projects have an explicit acceptance criterion for the readiness-deadline path.

package/blueprints/application-api-rest/README.md

@@ -1,6 +1,6 @@
 # application-api-rest blueprint (v2.0.0)
 
-The second content blueprint on the rcf-build-lite blueprint mechanism (design brief v2, ratified; Phase 3 of the blueprint programme). Scope: a REST service, single deployable, versioned wire contract, no UI in scope. Composes with the application-spa blueprint by design, including two deliberate scope:global conflicts.
+A content blueprint on the rcf-build-lite blueprint mechanism. Scope: a REST service, single deployable, versioned wire contract, no UI in scope. Composes with the application-spa blueprint by design, including two deliberate scope:global conflicts.
 
 ## Apply
 
@@ -27,9 +27,9 @@ The doc set is contributions (copied into the project tree by `rcf define bluepr
 
 ## What it contributes, and what it deliberately does not
 
-Contributed kinds: REQ, US (with inline ACs), TAC, ADR. Adherence is expressed as ACs; the blueprint ships no test files (ratified decision 5) and no code.
+Contributed kinds: REQ, US (with inline ACs), TAC, ADR. Adherence is expressed as ACs; the blueprint ships no test files (shipped policy 5) and no code.
 
-No FBS contributions, as a matter of principle (ratified policy 2026-08-19): FBSs are the work of the implementing agent, not the blueprint; project constraints have to be applied at the time of creation. The blueprint contributes the WHAT; the implementing agent derives the HOW-tasks (FBS) in the host project, where the ACs contributed here get picked up by the project's own build sequencing.
+No FBS contributions, as a matter of principle (policy): FBSs are the work of the implementing agent, not the blueprint; project constraints have to be applied at the time of creation. The blueprint contributes the WHAT; the implementing agent derives the HOW-tasks (FBS) in the host project, where the ACs contributed here get picked up by the project's own build sequencing.
 
 ## The four global decisions
 

package/blueprints/application-api-rest/blueprint.json

@@ -1,6 +1,6 @@
 {
   "slug": "application-api-rest",
-  "version": "2.1.5",
+  "version": "2.1.10",
   "category": "application",
   "contributions": [
     {
@@ -269,5 +269,6 @@
       "role": "errorHandling",
       "reason": "The error translator writes the wire envelope from the internal record; an error-handling companion supplies the record factory and the boundary that constructs it, and the shelf application-error-handling blueprint is the fallback when no library provider is registered."
     }
-  ]
+  ],
+  "updatedAt": "2026-09-11T16:04:17Z"
 }

package/blueprints/application-api-rest/contributions/adrs/adr-302-application-api-rest-auth-model.json

@@ -12,7 +12,7 @@
     {
       "name": "Per-endpoint auth annotations without classes",
       "summary": "Each endpoint declares its own middleware stack of auth requirements.",
-      "reasonNotChosen": "Infinite postures means no enumerable audit story; every endpoint is a bespoke security review, and rate limiting and audit logging cannot attach to anything stable."
+      "reasonNotChosen": "Infinite postures means no enumerable audit story; every endpoint is a bespoke security assessment, and rate limiting and audit logging cannot attach to anything stable."
     },
     {
       "name": "Gateway-terminated auth only",