rcf-lite 0.27.0 → 0.28.0

package/blueprints/observability-essentials/contributions/probes/liveness-probe.mjs

@@ -0,0 +1,84 @@
+// Liveness-probe probe for observability-essentials.
+//
+// Boots the fixture server, VARIES the input by supplying a distinct
+// x-request-id header per request, and observes the /live endpoint.
+//
+// AC-7101-1 requires the endpoint path to come from project
+// configuration under probeInterface.paths.liveness (no shipped
+// default). This probe uses a hard-coded '/live' path against the
+// fixture rather than reading a configured path from a downstream
+// project; row de-claimed (conformanceOnly, anchorAcId=null) with
+// the limitation naming AC-7101-1. The observation (HTTP 200 with
+// body.status='pass' on the healthy path) is retained.
+//
+// AC-7101-5 requires the unhealthy path to answer HTTP 503 with
+// content-length 0 AND for a follow-up GET while the predicate stays
+// fail to continue answering 503 AND for a GET after the predicate
+// returns pass to answer 200. This probe exercises all three requests
+// (unhealthy, repeat unhealthy, restored healthy) and anchors AC-7101-5.
+
+import { randomUUID } from 'node:crypto';
+import { createProbeServer } from '../../../../packages/rcf-lite/test/fixtures/probe-pack-observability-essentials/src/probe-server.mjs';
+import { envPort } from './probe-utils.mjs';
+
+export const anchorAcId = 'AC-7101-5';
+export const accountBound = false;
+const AC5 = 'A liveness handler on a process whose in-process';
+const LIM_7101_1 = `AC-7101-1: requires the liveness endpoint path to come from project configuration under probeInterface.paths.liveness (no shipped default from v2.0.0). This row observes the endpoint behaviour at the hard-coded fixture path '/live'; it does not observe the path being sourced from configuration in a downstream project.`;
+
+async function get(port, path, headers) {
+  const res = await fetch(`http://127.0.0.1:${port}${path}`, { headers });
+  const text = await res.text();
+  let parsed = null; try { parsed = JSON.parse(text); } catch {}
+  return { status: res.status, requestId: res.headers.get('x-request-id'), contentLength: res.headers.get('content-length'), body: text, parsed };
+}
+
+export default async function runProbe() {
+  const srv = createProbeServer();
+  const { port } = await srv.listen(envPort());
+  const results = [];
+  const healthyIds = [randomUUID(), randomUUID(), randomUUID()];
+  const healthyObserved = [];
+  let unhealthyObserved, repeatObserved, restoredObserved;
+  try {
+    for (const rid of healthyIds) {
+      const r = await get(port, '/live', { 'x-request-id': rid });
+      healthyObserved.push({ supplied: rid, echoedHeader: r.requestId, echoedBody: r.parsed?.requestIdEchoed, status: r.status, bodyStatus: r.parsed?.status });
+    }
+    const allEchoed = healthyObserved.every((o) => o.status === 200 && o.echoedHeader === o.supplied && o.echoedBody === o.supplied && o.bodyStatus === 'pass');
+    results.push({
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: LIM_7101_1,
+      verdict: allEchoed ? 'pass' : 'fail',
+      detail: `observed ${healthyIds.length} varied x-request-id inputs at the hard-coded fixture path '/live'; every response is HTTP 200 with body.status='pass' and header/body echo the supplied id. Path-from-configuration clause not observed.`,
+      evidence: { variedInputs: healthyIds, observed: healthyObserved },
+    });
+
+    srv.setLivenessUnhealthy(true);
+    const badId = randomUUID();
+    const bad = await get(port, '/live', { 'x-request-id': badId });
+    unhealthyObserved = { supplied: badId, echoedHeader: bad.requestId, status: bad.status, contentLength: bad.contentLength, bodyLength: bad.body.length };
+    const badId2 = randomUUID();
+    const bad2 = await get(port, '/live', { 'x-request-id': badId2 });
+    repeatObserved = { supplied: badId2, echoedHeader: bad2.requestId, status: bad2.status, contentLength: bad2.contentLength, bodyLength: bad2.body.length };
+    srv.setLivenessUnhealthy(false);
+    const goodId = randomUUID();
+    const restored = await get(port, '/live', { 'x-request-id': goodId });
+    restoredObserved = { supplied: goodId, echoedHeader: restored.requestId, status: restored.status, bodyStatus: restored.parsed?.status };
+
+    const failOk = bad.status === 503 && (bad.contentLength === '0' || bad.body.length === 0) && bad.requestId === badId;
+    const repeatOk = bad2.status === 503 && (bad2.contentLength === '0' || bad2.body.length === 0) && bad2.requestId === badId2;
+    const restoredOk = restored.status === 200 && restored.parsed?.status === 'pass' && restored.requestId === goodId;
+    results.push({
+      anchorAcId: 'AC-7101-5',
+      verdict: failOk && repeatOk && restoredOk ? 'pass' : 'fail',
+      detail: `${AC5}  -  fail: HTTP ${bad.status} content-length='${bad.contentLength}' bodyLength=${bad.body.length}; repeat-fail: HTTP ${bad2.status} content-length='${bad2.contentLength}' bodyLength=${bad2.body.length}; restored-pass: HTTP ${restored.status} body.status='${restored.parsed?.status}'. Observes AC-7101-5 three-step contract (503 -> 503 while predicate fails -> 200 after predicate restored).`,
+      evidence: { variedInput: badId, observed: unhealthyObserved, repeatObserved, restoredObserved },
+    });
+  } finally {
+    srv.setLivenessUnhealthy(false);
+    await srv.close();
+  }
+  return { results, extra: { envDeclared: ['RCF_FIXTURE_OBS_ESS_PORT'], boundPort: port, variedInputs: healthyIds, healthyObserved, unhealthyObserved, repeatObserved, restoredObserved } };
+}

package/blueprints/observability-essentials/contributions/probes/metrics-endpoint.mjs

@@ -0,0 +1,96 @@
+// Status-page probe for observability-essentials (kept under the
+// legacy metrics-endpoint filename so the run-metrics-endpoint.mjs
+// wrapper and the anatomy test's PROBES list continue to resolve
+// without shipping a rename in the same patch).
+//
+// Anchors AC-7104-2 and AC-7104-3 by asking the fixture for /status
+// with declared components in mixed states. AC-7104-2 requires each
+// component's state attribute to EQUAL the declared current state
+// AND be drawn from the fixed enum. AC-7104-3 requires render order
+// equals declaration order. AC-7104-1 (configured-path clause) is
+// de-claimed to conformanceOnly: the shipped probe-server hard-codes
+// '/status' rather than accepting a paths.status option, so the
+// configuration-provenance property is not observed here (the strict-evidence contract).
+// Every retained row records the server-echoed x-request-id header
+// as its identifier alongside the derived rendered lists.
+// Every detail line begins with the first eight words of the anchored
+// AC text.
+import { randomUUID } from 'node:crypto';
+import { createProbeServer } from '../../../../packages/rcf-lite/test/fixtures/probe-pack-observability-essentials/src/probe-server.mjs';
+import { envPort } from './probe-utils.mjs';
+
+export const anchorAcId = 'AC-7104-2';
+export const accountBound = false;
+const AC2 = 'Each rendered component element carries its current state';
+const AC3 = 'The component render order on the page matches';
+
+const DECLARED = [
+  { name: 'api', state: 'operational' },
+  { name: 'jobs', state: 'degraded' },
+  { name: 'billing', state: 'outage' },
+  { name: 'search', state: 'maintenance' },
+];
+const ALLOWED_STATES = new Set(['operational', 'degraded', 'outage', 'maintenance']);
+
+function parseComponents(html) {
+  const parsed = [];
+  const re = /<li[^>]*class="component"[^>]*data-name="([^"]*)"[^>]*data-state="([^"]*)"[^>]*>([^<]*)<\/li>/g;
+  let m;
+  while ((m = re.exec(html)) !== null) parsed.push({ nameAttr: m[1], stateAttr: m[2], text: m[3] });
+  return parsed;
+}
+
+export default async function runProbe() {
+  const srv = createProbeServer();
+  srv.setComponents(DECLARED);
+  const { port } = await srv.listen(envPort());
+  const results = [];
+  let firstBody, contentType;
+  try {
+    const suppliedRequestId = randomUUID();
+    const res = await fetch(`http://127.0.0.1:${port}/status`, { headers: { 'x-request-id': suppliedRequestId } });
+    contentType = res.headers.get('content-type');
+    const echoedRequestId = res.headers.get('x-request-id');
+    firstBody = await res.text();
+    const parsed = parseComponents(firstBody);
+    // AC-7104-1: exact declared list (count AND each rendered name
+    // equals declared name at same position AND text content equals
+    // the declared name). Row de-claimed (conformanceOnly, the strict-evidence contract)
+    // because the shipped probe-server hard-codes '/status' rather
+    // than accepting a paths.status option; the configured-path
+    // clause on AC-7104-1 is not observed here.
+    const namesMatch = parsed.length === DECLARED.length && parsed.every((c, i) => c.nameAttr === DECLARED[i].name && c.text === DECLARED[i].name);
+    const declaredSet = new Set(DECLARED.map((d) => d.name));
+    const renderedSet = new Set(parsed.map((c) => c.nameAttr));
+    const phantom = [...renderedSet].filter((n) => !declaredSet.has(n));
+    const missing = [...declaredSet].filter((n) => !renderedSet.has(n));
+    results.push({
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: `AC-7104-1: the configured-path clause requires the fixture to accept an explicit paths.status option and refuse when the shipped default is used unwrapped. This probe uses the hard-coded '/status' path in both the probe and the fixture, so configuration provenance is not observed here.`,
+      verdict: res.status === 200 && (contentType || '').startsWith('text/html') && namesMatch && phantom.length === 0 && missing.length === 0 ? 'pass' : 'fail',
+      detail: `observed GET /status -> ${res.status} content-type='${contentType}'; rendered ${parsed.length} components; declared=${JSON.stringify(DECLARED.map((d) => d.name))}; rendered=${JSON.stringify(parsed.map((c) => c.nameAttr))}; phantom=${JSON.stringify(phantom)}; missing=${JSON.stringify(missing)}; namesAndTextMatch=${namesMatch}. AC-7104-1 configured-path clause not exercised.`,
+      evidence: { status: res.status, contentType, componentsFound: parsed.length, componentsDeclared: DECLARED.length, bodyExcerpt: firstBody.slice(0, 500), declared: DECLARED.map((d) => d.name), rendered: parsed.map((c) => c.nameAttr), phantom, missing },
+    });
+    // AC-7104-2: each state EQUALS declared state AND is in enum.
+    const enumOk = parsed.length > 0 && parsed.every((c) => ALLOWED_STATES.has(c.stateAttr));
+    const equalityOk = parsed.length === DECLARED.length && parsed.every((c, i) => c.stateAttr === DECLARED[i].state);
+    const mismatches = parsed.map((c, i) => ({ name: c.nameAttr, rendered: c.stateAttr, declared: DECLARED[i]?.state })).filter((r) => r.rendered !== r.declared);
+    results.push({
+      anchorAcId: 'AC-7104-2',
+      verdict: enumOk && equalityOk && echoedRequestId === suppliedRequestId ? 'pass' : 'fail',
+      detail: `${AC2} as a machine-readable attribute drawn from  -  observed every rendered component's data-state; suppliedInput='${suppliedRequestId}' echoedHeader='${echoedRequestId}' echoMatches=${echoedRequestId === suppliedRequestId}; enumMembership=${enumOk}; equalsDeclaredState=${equalityOk}; mismatches=${JSON.stringify(mismatches)}.`,
+      evidence: { suppliedInput: suppliedRequestId, derivedResponseHeader: echoedRequestId, stateAttrs: parsed.map((c) => c.stateAttr), declaredStates: DECLARED.map((d) => d.state), enumMembership: enumOk, equalsDeclared: equalityOk, mismatches, bodyExcerpt: firstBody.slice(0, 500) },
+    });
+    const orderMatches = parsed.length === DECLARED.length && parsed.every((c, i) => c.nameAttr === DECLARED[i].name);
+    results.push({
+      anchorAcId: 'AC-7104-3',
+      verdict: orderMatches && echoedRequestId === suppliedRequestId ? 'pass' : 'fail',
+      detail: `${AC3} the declaration order in configuration  -  observed rendered order=${JSON.stringify(parsed.map((c) => c.nameAttr))}; declared order=${JSON.stringify(DECLARED.map((c) => c.name))}; matches=${orderMatches}; suppliedInput='${suppliedRequestId}' echoedHeader='${echoedRequestId}'.`,
+      evidence: { suppliedInput: suppliedRequestId, derivedResponseHeader: echoedRequestId, renderedOrder: parsed.map((c) => c.nameAttr), declaredOrder: DECLARED.map((c) => c.name), matches: orderMatches, bodyExcerpt: firstBody.slice(0, 500) },
+    });
+  } finally {
+    await srv.close();
+  }
+  return { results, extra: { envDeclared: ['RCF_FIXTURE_OBS_ESS_PORT'], boundPort: port, declaredComponents: DECLARED, contentType, statusPageBodyExcerpt: (firstBody || '').slice(0, 500) } };
+}

package/blueprints/observability-essentials/contributions/probes/probe-utils.mjs

@@ -0,0 +1,52 @@
+import { mkdir, writeFile } from 'node:fs/promises';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+export const PROJECT_ROOT = resolve(HERE, '..', '..', '..', '..');
+export const FIXTURE_DIR = resolve(PROJECT_ROOT, 'packages/rcf-lite/test/fixtures/probe-pack-observability-essentials');
+export const REPORT_DIR = resolve(PROJECT_ROOT, '.rcf/reports/blueprints/observability-essentials');
+export const DECLARED_ENV = new Set(['RCF_FIXTURE_OBS_ESS_PORT']);
+
+export function aggregate(results) {
+  if (!Array.isArray(results) || results.length === 0) return 'fail';
+  if (results.some((r) => r.verdict === 'fail')) return 'fail';
+  if (results.some((r) => r.verdict === 'warn')) return 'warn';
+  return 'pass';
+}
+export function isSkipped(results) { return Array.isArray(results) && results.length > 0 && results.every((r) => r.accountBoundSkipped === true); }
+export async function writeReport({ probeName, engine, results, extra }) {
+  await mkdir(REPORT_DIR, { recursive: true });
+  const normalised = (Array.isArray(results) && results.length > 0)
+    ? results
+    : [{ anchorAcId: null, harnessError: true, verdict: 'fail', detail: 'no checks ran', evidence: { reason: 'no checks ran', probeName, runAt: new Date().toISOString(), engine } }];
+  const raw = aggregate(normalised);
+  const aggregateVerdict = isSkipped(normalised) ? 'pass' : raw;
+  const report = { slug: 'observability-essentials', probeName, runAt: new Date().toISOString(), engine, results: normalised, aggregateVerdict, ...(extra ?? {}) };
+  const path = resolve(REPORT_DIR, `${probeName}.json`);
+  await writeFile(path, JSON.stringify(report, null, 2) + '\n', 'utf8');
+  return { report, path };
+}
+export async function runShim(probeName, engine, mainFn) {
+  try {
+    const outcome = (await mainFn()) ?? { results: [] };
+    const { results, extra } = outcome;
+    const { report, path } = await writeReport({ probeName, engine, results, extra });
+    process.stdout.write(JSON.stringify(report, null, 2) + '\n');
+    process.stdout.write(`report written to ${path}\n`);
+    if (report.aggregateVerdict === 'fail') process.exitCode = 1;
+  } catch (err) {
+    const results = [{ anchorAcId: null, harnessError: true, verdict: 'fail', detail: `probe threw: ${err?.message ?? err}`, evidence: { thrown: true, message: err?.message ?? String(err), name: err?.name ?? 'Error', probeName, runAt: new Date().toISOString(), engine } }];
+    const { report, path } = await writeReport({ probeName, engine, results });
+    process.stdout.write(JSON.stringify(report, null, 2) + '\n');
+    process.stderr.write(`probe error: ${err?.stack ?? err}\n`);
+    process.stderr.write(`report written to ${path}\n`);
+    process.exitCode = 1;
+  }
+}
+export function envPort() {
+  const raw = process.env.RCF_FIXTURE_OBS_ESS_PORT;
+  if (raw === undefined || raw === '') return 0;
+  const n = Number(raw);
+  return Number.isInteger(n) && n >= 0 && n <= 65535 ? n : 0;
+}

package/blueprints/observability-essentials/contributions/probes/readiness-probe.mjs

@@ -0,0 +1,171 @@
+// Readiness-probe probe for observability-essentials.
+//
+// AC-7102-1 requires the readiness endpoint to be served at a path
+// SUPPLIED BY PROJECT CONFIGURATION under probeInterface.paths.readiness
+// (no shipped default from v2.0.0), and that path MUST be distinct
+// from the liveness path. This probe boots the fixture with an
+// explicit non-default readiness path and a distinct liveness path
+// (both sourced from the probe's configuration input), then asserts:
+//   - a GET at the CONFIGURED readiness path returns 200 body.status=pass
+//     when the declared dependency is healthy;
+//   - a GET at the CONFIGURED readiness path returns 503 body.status=fail
+//     when the declared dependency has failed;
+//   - a GET at the SAME readiness path when the liveness path is /live-cfg
+//     is NOT reached by the liveness handler (distinctness);
+//   - a GET at the liveness path against the same listener returns
+//     the liveness body shape, not the readiness body shape.
+//
+// Teardown closes the fixture http server first and propagates any
+// error from a registered teardown callback; a failing teardown fails
+// the verdict.
+//
+// AC-7103-1 (boot-refusal on missing/malformed declaration) and
+// AC-7103-2 (checkedAt within a fixture-configured evaluation budget)
+// are de-claimed with limitations naming the respective ACs.
+
+import { randomUUID } from 'node:crypto';
+import { createServer } from 'node:net';
+import { createProbeServer } from '../../../../packages/rcf-lite/test/fixtures/probe-pack-observability-essentials/src/probe-server.mjs';
+import { envPort } from './probe-utils.mjs';
+
+export const anchorAcId = 'AC-7102-1';
+export const accountBound = false;
+const AC1 = 'The application serves the readiness endpoint at a';
+
+const LIM_7103_1 = `AC-7103-1: requires the readiness dependency set to be declared at boot AND the endpoint to refuse a missing or malformed declaration at boot. This row observes only the checks object shape at request time; the boot-refusal clause is not observed.`;
+const LIM_7103_2 = `AC-7103-2: requires the checks[name].checkedAt timestamp to be no older than an evaluation budget declared in fixture configuration. This row applies a probe-authored 5000 ms upper-bound constant, not a value declared in fixture configuration.`;
+
+// Configuration-sourced paths (probe's stand-in for project config
+// under probeInterface.paths.*). Deliberately non-default so the
+// observation cannot be a lucky match against a shipped default.
+const CONFIGURED_PATHS = { liveness: '/live-cfg-v2', readiness: '/readiness-cfg-v2' };
+
+async function openStubTcp() {
+  return new Promise((resolve, reject) => {
+    const s = createServer((sock) => { sock.destroy(); });
+    s.once('error', reject);
+    s.listen(0, '127.0.0.1', () => resolve({ server: s, port: s.address().port }));
+  });
+}
+
+async function get(port, path, headers) {
+  const res = await fetch(`http://127.0.0.1:${port}${path}`, { headers });
+  const text = await res.text();
+  let parsed = null; try { parsed = JSON.parse(text); } catch {}
+  return { status: res.status, requestId: res.headers.get('x-request-id'), body: text, parsed };
+}
+
+export default async function runProbe() {
+  const srv = createProbeServer({ paths: CONFIGURED_PATHS });
+  const stub = await openStubTcp();
+  let stubClosed = false;
+  srv.addTcpDependency('probe-stub-tcp', '127.0.0.1', stub.port);
+  srv.registerTeardown(async () => {
+    if (stubClosed) return;
+    await new Promise((resolve, reject) => stub.server.close((err) => (err ? reject(err) : resolve())));
+    stubClosed = true;
+  });
+  const { port } = await srv.listen(envPort());
+  const results = [];
+  const supplied = { host: '127.0.0.1', port: stub.port, name: 'probe-stub-tcp' };
+  const readinessPathFromConfig = CONFIGURED_PATHS.readiness;
+  const livenessPathFromConfig = CONFIGURED_PATHS.liveness;
+  const readinessPathServed = srv.resolvedPaths?.readiness;
+  const livenessPathServed = srv.resolvedPaths?.liveness;
+  const pathsDistinct = readinessPathFromConfig !== livenessPathFromConfig
+    && readinessPathServed === readinessPathFromConfig
+    && livenessPathServed === livenessPathFromConfig;
+  let readyObs, unreadyObs, distinctnessObs, defaultAbsent;
+  try {
+    // Healthy GET at the CONFIGURED readiness path.
+    const rid1 = randomUUID();
+    const ready = await get(port, readinessPathFromConfig, { 'x-request-id': rid1 });
+    const passEntry = ready.parsed?.checks?.['probe-stub-tcp'];
+    readyObs = { status: ready.status, requestId: ready.requestId, echoedBody: ready.parsed?.requestIdEchoed, checks: ready.parsed?.checks };
+    // Confirm the shipped default path '/ready' is NOT served (the
+    // fixture routes the readiness handler to the CONFIGURED path).
+    const defaultRes = await fetch(`http://127.0.0.1:${port}/ready`);
+    defaultAbsent = defaultRes.status === 404;
+
+    results.push({
+      anchorAcId: 'AC-7102-1',
+      verdict: pathsDistinct && defaultAbsent && ready.status === 200 && ready.parsed?.status === 'pass' && ready.requestId === rid1 ? 'pass' : 'fail',
+      detail: `${AC1}  -  GET ${readinessPathFromConfig} (from probe configuration input, no shipped default) with stub tcp open on port ${stub.port} -> ${ready.status} body.status='${ready.parsed?.status}'; configured liveness path='${livenessPathFromConfig}' is distinct; the shipped default '/ready' returns ${defaultRes.status} (expect 404 = default absent). Observes AC-7102-1 configuration-sourced-path + distinct-from-liveness + 200-on-healthy clauses.`,
+      evidence: {
+        suppliedInput: rid1,
+        derivedResponseHeader: ready.requestId,
+        readinessPathFromConfig,
+        livenessPathDistinct: `configured='${livenessPathFromConfig}' vs readiness='${readinessPathFromConfig}'`,
+        readinessPathServedByFixture: readinessPathServed,
+        livenessPathServedByFixture: livenessPathServed,
+        defaultReadyStatus: defaultRes.status,
+        defaultAbsent,
+        pathsDistinct,
+        suppliedDependency: supplied,
+        observed: readyObs,
+        bodyExcerpt: ready.body.slice(0, 300),
+      },
+    });
+    results.push({
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: LIM_7103_1,
+      verdict: ready.parsed?.checks && typeof ready.parsed.checks === 'object' && Object.keys(ready.parsed.checks).length === 1 && passEntry ? 'pass' : 'fail',
+      detail: `AC-7103-1 boot-declaration: checks object keys=${JSON.stringify(Object.keys(ready.parsed?.checks || {}))}; the boot-refusal clause on AC-7103-1 (missing or malformed declaration refused at boot) is not observed here.`,
+      evidence: { checksKeys: Object.keys(ready.parsed?.checks || {}), entry: passEntry },
+    });
+    results.push({
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: LIM_7103_2,
+      verdict: passEntry && (passEntry.state === 'pass' || passEntry.state === 'fail') && typeof passEntry.checkedAt === 'string' && !Number.isNaN(Date.parse(passEntry.checkedAt)) && (Date.now() - Date.parse(passEntry.checkedAt)) <= 5000 ? 'pass' : 'fail',
+      detail: `AC-7103-2 checked-at budget: checks['probe-stub-tcp'] state='${passEntry?.state}' checkedAt='${passEntry?.checkedAt}'; state in {pass,fail} AND ISO-8601 checkedAt observed. Evaluation-budget upper bound is a probe-authored 5000 ms constant, not a fixture-configured value.`,
+      evidence: { entry: passEntry },
+    });
+
+    // Distinctness observation: GET the configured LIVENESS path,
+    // confirm the response is the liveness body shape (no checks{}).
+    const ridDistinct = randomUUID();
+    const distinct = await get(port, livenessPathFromConfig, { 'x-request-id': ridDistinct });
+    distinctnessObs = { status: distinct.status, requestId: distinct.requestId, hasChecks: Boolean(distinct.parsed?.checks), bodyStatus: distinct.parsed?.status };
+    results.push({
+      anchorAcId: 'AC-7102-1',
+      verdict: pathsDistinct && distinct.status === 200 && distinct.parsed?.status === 'pass' && distinctnessObs.hasChecks === false && distinct.requestId === ridDistinct ? 'pass' : 'fail',
+      detail: `${AC1}  -  distinctness: GET ${livenessPathFromConfig} (liveness) -> ${distinct.status} body.status='${distinct.parsed?.status}' checks-present=${distinctnessObs.hasChecks} (readiness body shape carries a checks object; liveness body shape does not). Observes AC-7102-1 readiness-distinct-from-liveness clause.`,
+      evidence: {
+        suppliedInput: ridDistinct,
+        derivedResponseHeader: distinct.requestId,
+        readinessPathFromConfig,
+        livenessPathDistinct: `configured='${livenessPathFromConfig}' vs readiness='${readinessPathFromConfig}'`,
+        observed: distinctnessObs,
+        bodyExcerpt: distinct.body.slice(0, 300),
+      },
+    });
+
+    // Unhealthy GET at the CONFIGURED readiness path.
+    await new Promise((resolve, reject) => stub.server.close((err) => (err ? reject(err) : resolve())));
+    stubClosed = true;
+    const rid2 = randomUUID();
+    const unready = await get(port, readinessPathFromConfig, { 'x-request-id': rid2 });
+    const failEntry = unready.parsed?.checks?.['probe-stub-tcp'];
+    unreadyObs = { status: unready.status, requestId: unready.requestId, checks: unready.parsed?.checks, unreadyDependencies: unready.parsed?.unreadyDependencies };
+    results.push({
+      anchorAcId: 'AC-7102-1',
+      verdict: pathsDistinct && unready.status === 503 && unready.parsed?.status === 'fail' && unready.requestId === rid2 && failEntry?.state === 'fail' ? 'pass' : 'fail',
+      detail: `${AC1}  -  after stub tcp closed on port ${stub.port}: GET ${readinessPathFromConfig} -> ${unready.status} body.status='${unready.parsed?.status}' checks['probe-stub-tcp'].state='${failEntry?.state}'; observes AC-7102-1 503+body.status='fail' clause on the configured path.`,
+      evidence: {
+        suppliedInput: rid2,
+        derivedResponseHeader: unready.requestId,
+        readinessPathFromConfig,
+        livenessPathDistinct: `configured='${livenessPathFromConfig}' vs readiness='${readinessPathFromConfig}'`,
+        closedDependency: supplied,
+        observed: unreadyObs,
+        entry: failEntry,
+        bodyExcerpt: unready.body.slice(0, 300),
+      },
+    });
+  } finally {
+    await srv.close();
+  }
+  return { results, extra: { envDeclared: ['RCF_FIXTURE_OBS_ESS_PORT'], boundPort: port, suppliedDependency: supplied, configuredPaths: CONFIGURED_PATHS, resolvedPaths: srv.resolvedPaths, readyObserved: readyObs, unreadyObserved: unreadyObs, distinctnessObserved: distinctnessObs, defaultReadyPathAbsent: defaultAbsent } };
+}

package/blueprints/observability-essentials/contributions/probes/run-liveness-probe.mjs

@@ -0,0 +1,3 @@
+import runProbe from './liveness-probe.mjs';
+import { runShim } from './probe-utils.mjs';
+runShim('liveness-probe', { kind: 'http', driver: 'node:http fixture probe-server on 127.0.0.1', healthy: true }, runProbe);

package/blueprints/observability-essentials/contributions/probes/run-metrics-endpoint.mjs

@@ -0,0 +1,3 @@
+import runProbe from './metrics-endpoint.mjs';
+import { runShim } from './probe-utils.mjs';
+runShim('metrics-endpoint', { kind: 'http', driver: 'node:http fixture probe-server on 127.0.0.1', healthy: true }, runProbe);

package/blueprints/observability-essentials/contributions/probes/run-readiness-probe.mjs

@@ -0,0 +1,3 @@
+import runProbe from './readiness-probe.mjs';
+import { runShim } from './probe-utils.mjs';
+runShim('readiness-probe', { kind: 'http', driver: 'node:http fixture probe-server on 127.0.0.1', healthy: true }, runProbe);

package/blueprints/observability-essentials/docs/topics.md

@@ -29,7 +29,7 @@ Rules for new topics (inherited from the application-spa, application-api-rest,
 
 ## Id number bands (registry bootstrap)
 
-AC ids (and therefore US numeric ids, which anchor them) are NOT namespaced by the 0.4.4 schema grammar; the band allocation IS the AC-collision enforcement mechanism. Composing blueprints take a fresh band rather than proposing namespaced AC ids. Band allocation is ratified policy (2026-08-19); this table is the shared registry-bootstrap replicated across every shipped and forthcoming blueprint's `docs/topics.md` until a mechanism-side central registry lands (v1.1 candidate).
+AC ids (and therefore US numeric ids, which anchor them) are NOT namespaced by the 0.4.4 schema grammar; the band allocation IS the AC-collision enforcement mechanism. Composing blueprints take a fresh band rather than proposing namespaced AC ids. Band allocation is policy; this table is the shared registry-bootstrap replicated across every shipped and forthcoming blueprint's `docs/topics.md` until a mechanism-side central registry lands (v1.1 candidate).
 
 This table is maintained shelf-wide across every blueprint's `docs/topics.md`. Rows are recorded at ship, never predicted.
 
@@ -74,8 +74,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | platform-docker-compose-host | 38101-38899 | 39xx | shipped v1.0.0 | `containerHostContract` |
 | edge-cloudflare-tunnel | 39101-39899 | 40xx | shipped v1.0.0 | `edgeIngressBridge` |
 
-US 7101-7110 sit at the LOW end of the 7101-7899 band on purpose. A project-side story that mechanically derives from an observability-essentials REQs id into the number `7110` would collide against observability-essentials-US-7110 in this package; the band leaves headroom at the HIGH end (US 7181-7899) so a project's own stories anchored to observability-essentials REQs can allocate without conflict. The watchpost run4 lesson applies here too.
-
+US 7101-7110 sit at the LOW end of the 7101-7899 band on purpose. A project-side story that mechanically derives from an observability-essentials REQs id into the number `7110` would collide against observability-essentials-US-7110 in this package; the band leaves headroom at the HIGH end (US 7181-7899) so a project's own stories anchored to observability-essentials REQs can allocate without conflict.
 Row-status caveat: the delivery-ci-workflows seat shipped first (PR #95 merged at 595cab9c on main). This branch was rebased onto that main; the delivery-ci-workflows row reflects the shipped state, and the observability row flips to `shipped v1.0.0` at this branch's merge (the maintainer coordinates that final flip in the merge commit or an immediate follow-up).
 
 ## Shared expectations for future composing blueprints

package/blueprints/observability-logging/CHANGELOG.md

@@ -1,18 +1,43 @@
+# Changelog
+
+## 1.3.7 - 2026-09-11
+
+Identifier-pairing rule tightened to equality. `line-shape-and-fields` now records each AC-15101-1/-3/-4 row's supplied correlation id under `suppliedInput` (with the parsed log-line object under `line`) so the row can be verified as `line.correlationId === suppliedInput`; the AC-15101-1 row also carries the observedEmissions list its detail already names. `correlation-id-flow` AC-15102-1 header-absent row records the fixture-minted UUID as an engine-minted `requestId` (with `absentSuppliedInput: true` for readability) instead of a `<no-header>` sentinel that could not equal the echoed value.
+
+## 1.3.6 - 2026-09-11
+
+redaction-boundary probe now emits one payload per recommended-default category (credential, token, bearer, pii.email, pii.name, pii.address) inside its own runWithCorrelation(randomUUID(), ...) so each row records a per-emission correlation id paired to the emitted line's correlationId; every one of the six mandatory categories AC-15103-1 names is now anchored to AC-15103-1 with derived redacted value AND payload-unmutated observation. The AC-15103-4-shaped row is emitted in its own correlation context and records the supplied/emitted correlationId pair alongside userId preservation and pii.email redaction. Anatomy helper strict-evidence contract tightened: bare `suppliedInput`, `headerName`, `workflowName`, `line.correlationId`, `observed[].supplied` and `observedRoundTrips[].supplied` no longer satisfy the identifier half on their own; each must be paired with the engine's echo of that value (echoedHeader, derivedResponseHeader, a returned resource id, or a log-line correlationId equal to the value the probe supplied).
+
+
+## 1.3.5 - 2026-09-11
+
+redaction-boundary probe now wraps each emission in runWithCorrelation(randomUUID(), ...) so every AC-15103-1 row and the AC-15103-4-shaped row carry a real per-emission correlation id as the identifier alongside the derived redacted value; the run-notes claim about redaction-boundary correlation ids is now true to the recorded rows. correlation-id-flow AC-15102-3 row (bare emission with correlationId=null by design) is de-claimed to conformanceOnly, since a bare emission carries no engine-returned identifier.
+
+## 1.3.4 - 2026-09-11
+
+line-shape-and-fields probe now wraps every emission (per-level, BigInt, reserved-key-collision) in runWithCorrelation(randomUUID(), ...) so each emitted log line carries a real correlation id; the AC-15101-1/-3/-4 rows record the parsed line object plus a correlationIdEchoed identifier and a bodyExcerpt derived value.
+
 # observability-logging CHANGELOG
 
+## 1.3.3 - 2026-09-11
+
+Adds a contributions/probes/ pack (line-shape-and-fields, correlation-id-flow, redaction-boundary) with a fixture-side logger factory and HTTP transport under packages/rcf-lite/test/fixtures/probe-pack-observability-logging/. Probes run against the fixture on Node 24. No account gate.
+
+Anchoring: line-shape-and-fields anchors AC-15101-1/3/4 (seven-field minimum with per-field non-empty-string type checks and ISO-8601 timestamp; BigInt folded to a decimal string; reserved-key collision safety). correlation-id-flow anchors AC-15102-1 with BOTH the header-present clause (three varied inbound ids echoed on the response header, response body and emitted log line with a fixture-computed sequence and hash the probe recomputes locally) AND the header-absent clause (fixture mints a v4 UUID, response body carries mintedFromAbsent=true and the correlationId, the emitted line matches); also anchors AC-15102-3 (bare emission with no ambient context carries correlationId=null). The monotonic-sequence row de-claims with the limitation naming AC-15102-1. redaction-boundary anchors AC-15103-1 (top-level recommended-default category folded with `[REDACTED:<category>]` AND the caller's original payload object unmutated after log.info returns) and AC-15103-4 (the { user: { id, pii: { email } } } shape with user.id preserved and user.pii.email redacted, plus caller unmutated). The nested top-level pii row and the bare `note` row de-claim with limitations naming AC-15103-4 and AC-15103-3 respectively. probe-utils normalisation and thrown-error rows carry an evidence object; the fallback anchorAcId is null.
+
 ## 1.3.1 (register-sweep patch, 2026-09-10)
 
 - Register: neutral wording in shipped prose (no capability change).
 
-## 1.3.0 (hardening pass, 2026-09-09)
+## 1.3.0 (2026-09-09)
 
 - Removes `sessionInventory` from `capabilities[]`. The section 7c backing requirement never landed on this blueprint: a logging surface does not own or deliver a session-listing surface. The applied `security-auth-clerk` blueprint owns `sessionInventory` through `TAC-1003-security-auth-clerk-session-verifier.interfaces.sessionInventory` (being defined on the security branch tonight); a project that runs Clerk continues to gate the account-settings sessions surface via that capability, unchanged. Shelf-wide grep of `requiresAppliedCapabilities` names no consumer that requires `sessionInventory` from this blueprint; the soft consumer (`application-account-settings` probe pack check `AC-25106-1` via `readAppliedCapabilities`) reads the union across applied blueprints and is unaffected. Removal is reasoned per section 7c, not a downgrade of the semantic surface.
-- Adds `elicits[]` with four apply-time answers: `correlation-header-name` (string, default X-Correlation-Id; ADR-1602), `minimum-log-level` (enum trace/debug/info/warn/error/fatal, default info; ADR-1604), `redaction-categories-additions` (string, default blank; ADR-1603) and `boot-identity-fields` (string, JSON object with environment/serviceName/serviceVersion; REQ-005). Every option value is backed by a must-priority REQ description (section 7c criterion a). Closes the family-pass F-2 finding.
+- Adds `elicits[]` with four apply-time answers: `correlation-header-name` (string, default X-Correlation-Id; ADR-1602), `minimum-log-level` (enum trace/debug/info/warn/error/fatal, default info; ADR-1604), `redaction-categories-additions` (string, default blank; ADR-1603) and `boot-identity-fields` (string, JSON object with environment/serviceName/serviceVersion; REQ-005). Every option value is backed by a must-priority REQ description (section 7c criterion a).
 - Adds `ADR-1605-observability-logging-serialisation-refusal`: BigInt values fold to their decimal string form on the emitted line; circular references and function references are dropped with one stderr notice naming the offending dotted path. Closes the family-pass F-4 chain-contradiction specimen (TAC-1601 internalStructure previously described a BigInt fold while REQ-001 / AC-15101-2 described a drop). TAC-1601 internalStructure and responsibility 4 are rewritten to reference ADR-1605; the F-4 outcome split is separately observable at AC-15101-2 (drop for circular/function) and AC-15101-3 (BigInt fold).
 - Adds `REQ-006` and `US-15109` naming the `auditLog` capability explicitly: the audit-log stream carries actor, target, before, after and correlationId on the shared minimum field set the consumer (application-admin-console AC-21105-1) reads. Backs the `auditLog` token per section 7c.
 - Grows `US-15101` from 2 ACs to 5 ACs: adds AC-15101-3 (BigInt fold oracle), AC-15101-4 (reserved-name collision refusal), AC-15101-5 (ISO-8601 timestamp millisecond oracle). Every existing and new AC on the story carries `disposition`; ACs observing a specific TAC surface carry `ownerRef`.
 - Adds `deliveredBy` to every REQ: REQ-001/002/003/005 point at TAC-1601 or TAC-1602 interfaces the responsibility genuinely carries; REQ-004 delivered by ADR-1604. Closes 5 pass-2 lint findings; per-blueprint `rcf define blueprint lint-consistency` reports zero on pass 1 and pass 2.
-- Review fix pass (F-9): adds section 7a coverage-note descriptions to US-15106 and US-15108 recording the guide-and-TAC trace outcome (no additional mechanism-specific failure paths named beyond the two ACs each story already binds).
+- adds section 7a coverage-note descriptions to US-15106 and US-15108 recording the guide-and-TAC trace outcome (no additional mechanism-specific failure paths named beyond the two ACs each story already binds).
 - Register scan fix (customer-facing register): neutralises historical CHANGELOG entries (1.1.0 and 1.2.0) so shipped content carries no internal author names.
 
 ## 1.2.0 (visual round, spec 2026-09-06 section 5.4.2, operator Q2 default)
@@ -21,4 +46,4 @@
 
 ## 1.1.0 (visual round, spec 2026-09-04 section 5.5.2, operator Q2 default)
 
-- Declares `capabilities: [auditLog]` on `blueprint.json`. No other change. The new field is additive per section 6 of `blueprint-authoring.md` (an additive optional field with no global-topic change is a minor bump). Keeps a single grammar for capability declaration: consumer blueprints read the union of declared `capabilities[]` on applied blueprints, never the `providesRoles[]` -> capability inference. This is the ratified rule (one grammar, no role-to-capability inference); the section 6a table previously noted `auditLog` as "implicit through the `logging` role" and now names `observability-logging` as the explicit shelf provider. Consumed at apply time by the visual round `application-admin-console` blueprint to gate the audit-log surface (probe pack check `AC-21105-1`).
+- Declares `capabilities: [auditLog]` on `blueprint.json`. No other change. The new field is additive per section 6 of `blueprint-authoring.md` (an additive optional field with no global-topic change is a minor bump). Keeps a single grammar for capability declaration: consumer blueprints read the union of declared `capabilities[]` on applied blueprints, never the `providesRoles[]` -> capability inference. This is the shipped rule (one grammar, no role-to-capability inference); the section 6a table previously noted `auditLog` as "implicit through the `logging` role" and now names `observability-logging` as the explicit shelf provider. Consumed at apply time by the `application-admin-console` blueprint to gate the audit-log surface (probe pack check `AC-21105-1`).

package/blueprints/observability-logging/README.md

@@ -3,7 +3,7 @@
 Structured single-line JSON emission for a rcf-lite project. General enterprise practice, no vendor lock-in. Ships the shelf-canonical `logging` global topic on `ADR-1601-observability-logging-line-shape` (transferred from `application-api-rest-ADR-304`, retained there as superseded history). Provides the `logging` role for the companion-suggestion mechanism. From 1.1.0, declares `capabilities: [auditLog]` on `blueprint.json` so the application-admin-console probe pack activates the audit-log surface check `AC-21105-1` when this blueprint is applied on the project (one grammar; consumer blueprints read declared capabilities, never a role-to-capability inference).
 
 
-> Latest: **v1.3.0** (hardening pass, 2026-09-09). `capabilities: [auditLog]`; elicits: correlation-header-name, minimum-log-level, redaction-categories-additions, boot-identity-fields. See [CHANGELOG.md](CHANGELOG.md).
+> Latest: **v1.3.0**. `capabilities: [auditLog]`; elicits: correlation-header-name, minimum-log-level, redaction-categories-additions, boot-identity-fields. See [CHANGELOG.md](CHANGELOG.md).
 
 ## Apply
 
@@ -27,7 +27,7 @@ The doc set is contributions (copied into the project tree by `rcf define bluepr
 
 ## What it contributes, and what it deliberately does not
 
-Contributed kinds: REQ, US (with inline ACs), TAC, ADR. Adherence is expressed as ACs; the blueprint ships no test files (ratified decision 5) and no code.
+Contributed kinds: REQ, US (with inline ACs), TAC, ADR. Adherence is expressed as ACs; the blueprint ships no test files (shipped policy 5) and no code.
 
 Deliberately not contributed: a specific log-shipping transport (Elastic Common Schema over Logstash, Loki push endpoints, Datadog agent, Splunk HEC); a rotation policy for on-disk log files (the shipped emission target is stdout, and the surrounding platform owns the pipe); a metrics-export surface (out of scope, sits with the metrics-store companion when the shelf ships one); a distributed-tracing surface (spans, propagation, sampling; out of scope for v1). The choice of ECS library (Elastic's, `pino-elastic-common-schema`, a project-authored shim) stays project-side; the blueprint names the ECS-neutral field set the AC binds to.
 

package/blueprints/observability-logging/blueprint.json

@@ -1,6 +1,6 @@
 {
   "slug": "observability-logging",
-  "version": "1.3.1",
+  "version": "1.3.7",
   "category": "observability",
   "providesRoles": [
     "logging"
@@ -164,5 +164,6 @@
       "kind": "req",
       "path": "requirements/observability-logging-req-006.json"
     }
-  ]
+  ],
+  "updatedAt": "2026-09-11"
 }