rcf-lite 0.27.0 → 0.28.0

package/blueprints/observability-logging/contributions/probes/correlation-id-flow.mjs

@@ -0,0 +1,173 @@
+// Correlation-id-flow probe for observability-logging.
+//
+// Positive-evidence shape: the probe VARIES its inputs (a distinct
+// correlation-id supplied on an inbound HTTP request header per call)
+// and observes the DERIVED outputs the fixture computes: the emitted
+// log line's correlationId + a fixture-computed sequence + a hash the
+// fixture calculates from the id and its own sequence. The response
+// body carries the fixture-computed sequence and hash; the response
+// header carries the id.
+// The probe RECOMPUTES the hash locally (SHA-256(id + ":" + sequence)
+// truncated to 16 hex chars) and asserts it equals the fixture's
+// value. The fixture never publishes the id into a value the probe
+// asserts against a copy of itself; the assertion is on the derived
+// hash and the sequence's monotonic step, both of which the fixture
+// computes from the varied input.
+//
+// AC-15102-1 has two clauses: (a) header present -> header value on
+// every emitted log line for the request; (b) header absent -> the
+// application mints a v4 UUID and the same value appears on every
+// log line for the request. This probe exercises BOTH clauses.
+//
+// The nested no-context emission proves the ambient store falls back
+// to correlationId=null when nothing set it, so the http-set path
+// isn't a lucky coincidence with a module-level default.
+
+import { createHash, randomUUID } from 'node:crypto';
+import { createLogger, createLoggerHttp } from '../../../../packages/rcf-lite/test/fixtures/probe-pack-observability-logging/src/logger-factory.mjs';
+
+export const anchorAcId = 'AC-15102-1';
+export const accountBound = false;
+const AC1 = 'A request arriving with the elicited correlation header';
+const AC3 = 'A log emission with no ambient correlation context';
+
+const HEADER = 'X-Correlation-Id';
+const UUID_V4_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+
+function expectedHash(id, sequence) {
+  return createHash('sha256').update(`${id}:${sequence}`).digest('hex').slice(0, 16);
+}
+
+export default async function runProbe() {
+  const outBuf = [];
+  const logger = createLogger({ environment: 'qa', serviceName: 'probe-svc', serviceVersion: '0.0.1', outSink: (s) => outBuf.push(s), errSink: () => {} });
+  const http = createLoggerHttp({ headerName: HEADER.toLowerCase(), logger });
+  const { port } = await http.listen(0);
+  const results = [];
+  const inputIds = [randomUUID(), randomUUID(), randomUUID()];
+  const observed = [];
+  try {
+    for (const inbound of inputIds) {
+      const res = await fetch(`http://127.0.0.1:${port}/hello`, {
+        method: 'POST',
+        headers: { [HEADER]: inbound, 'content-type': 'text/plain' },
+        body: 'body-' + inbound.slice(0, 4),
+      });
+      const bodyText = await res.text();
+      let body = null; try { body = JSON.parse(bodyText); } catch {}
+      observed.push({
+        supplied: inbound,
+        headerEcho: res.headers.get(HEADER.toLowerCase()),
+        bodySequence: body?.sequence,
+        bodyHash: body?.hash,
+        bodyCorrelationId: body?.correlationId,
+        bodyMintedFromAbsent: body?.mintedFromAbsent,
+        status: res.status,
+      });
+    }
+    const emittedLines = outBuf.join('').split('\n').filter(Boolean).map((l) => JSON.parse(l));
+
+    for (let i = 0; i < inputIds.length; i++) {
+      const supplied = inputIds[i];
+      const o = observed[i];
+      const line = emittedLines.find((l) => l.correlationId === supplied && l.sequence === o.bodySequence);
+      const localHash = (typeof o.bodySequence === 'number') ? expectedHash(supplied, o.bodySequence) : null;
+      const lineOk = Boolean(line) && line.hash === localHash;
+      const bodyOk = o.status === 200 && typeof o.bodySequence === 'number' && o.bodyHash === localHash && o.bodyMintedFromAbsent === false;
+      const headerOk = o.headerEcho === supplied;
+      results.push({
+        anchorAcId: 'AC-15102-1',
+        verdict: lineOk && bodyOk && headerOk ? 'pass' : 'fail',
+        detail: `${AC1}  -  observed supplied inbound '${HEADER}'='${supplied}' -> line.correlationId='${line?.correlationId}' sequence=${line?.sequence} line.hash='${line?.hash}' locallyRecomputedHash='${localHash}' body.sequence=${o.bodySequence} body.hash='${o.bodyHash}' header='${o.headerEcho}' mintedFromAbsent=${o.bodyMintedFromAbsent}; observes AC-15102-1 header-present clause via header echo and derived hash equality.`,
+        evidence: {
+          suppliedInput: supplied,
+          derivedLogLine: line ? { message: line.message, correlationId: line.correlationId, path: line.path, sequence: line.sequence, hash: line.hash } : null,
+          derivedResponseHeader: o.headerEcho,
+          derivedResponseBodySequence: o.bodySequence,
+          derivedResponseBodyHash: o.bodyHash,
+          locallyRecomputedHash: localHash,
+          responseStatus: o.status,
+        },
+      });
+    }
+
+    // AC-15102-1 header-absent clause: send with no correlation header,
+    // observe the fixture mints a v4 UUID and the same value appears on
+    // the emitted log line.
+    const absentRes = await fetch(`http://127.0.0.1:${port}/hello`, {
+      method: 'POST',
+      headers: { 'content-type': 'text/plain' },
+      body: 'no-header-body',
+    });
+    const absentBodyText = await absentRes.text();
+    let absentBody = null; try { absentBody = JSON.parse(absentBodyText); } catch {}
+    const mintedId = absentBody?.correlationId ?? '';
+    const mintedIsV4 = UUID_V4_RE.test(mintedId);
+    const echoedInHeader = absentRes.headers.get(HEADER.toLowerCase());
+    const linesAfter = outBuf.join('').split('\n').filter(Boolean).map((l) => JSON.parse(l));
+    const absentLine = linesAfter.find((l) => l.correlationId === mintedId && l.sequence === absentBody?.sequence);
+    const absentOk = absentRes.status === 200
+      && mintedIsV4
+      && absentBody?.mintedFromAbsent === true
+      && echoedInHeader === mintedId
+      && Boolean(absentLine);
+    results.push({
+      anchorAcId: 'AC-15102-1',
+      verdict: absentOk ? 'pass' : 'fail',
+      detail: `${AC1}  -  observed inbound with NO '${HEADER}' header -> body.correlationId='${mintedId}' (v4?${mintedIsV4}) mintedFromAbsent=${absentBody?.mintedFromAbsent} header echo='${echoedInHeader}' log-line.correlationId='${absentLine?.correlationId}' sequence=${absentLine?.sequence}; observes AC-15102-1 header-absent clause via minted v4 UUID appearing on the emitted line.`,
+      evidence: {
+        // No header supplied on this request; the fixture mints a v4
+        // UUID and echoes it verbatim on the response header, the
+        // response body and the emitted log line. The minted id is
+        // recorded as a request id (engine-minted lane) because it is
+        // the engine's response identifier, not a probe-supplied
+        // input; a bare `suppliedInput` sentinel would break the
+        // identifier-pairing equality rule.
+        requestId: mintedId,
+        absentSuppliedInput: true,
+        derivedLogLine: absentLine ? { message: absentLine.message, correlationId: absentLine.correlationId, path: absentLine.path, sequence: absentLine.sequence, hash: absentLine.hash } : null,
+        derivedResponseHeader: echoedInHeader,
+        derivedResponseBodySequence: absentBody?.sequence,
+        derivedResponseBodyHash: absentBody?.hash,
+        responseStatus: absentRes.status,
+        mintedFromAbsent: absentBody?.mintedFromAbsent,
+        mintedIsV4,
+      },
+    });
+
+    const seqs = observed.map((o) => o.bodySequence);
+    const monotonic = seqs.every((n, i) => typeof n === 'number' && (i === 0 || n === seqs[i - 1] + 1));
+    results.push({
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: 'AC-15102-1: concerns the correlation ID travelling from the inbound header (or minted UUID) to every emitted log line during the request. Sequence monotonicity is anti-echo signalling that the fixture computes derived state; it is not the AC-15102-1 property.',
+      verdict: monotonic ? 'pass' : 'fail',
+      detail: `observed fixture per-server sequence as ${JSON.stringify(seqs)}; monotonic step of 1 (anti-echo signal that fixture computes derived state).`,
+      evidence: { suppliedInputs: inputIds, derivedSequences: seqs, derivedResponseHeader: observed[0]?.headerEcho, suppliedInput: inputIds[0], bodyExcerpt: 'seq=' + JSON.stringify(seqs) },
+    });
+
+    outBuf.length = 0;
+    logger.info('bare');
+    const bare = JSON.parse(outBuf.join('').split('\n').filter(Boolean)[0]);
+    results.push({
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: `AC-15102-3: the bare emission with no ambient correlation context is a single emitted log line whose only recorded value is the null correlationId itself. The row observes the property but carries no request or resource identifier the engine returned; identifier-plus-derived evidence is not available here (the strict-evidence contract tightening).`,
+      verdict: bare.correlationId === null ? 'pass' : 'fail',
+      detail: `${AC3}  -  observed bare emission (no runWithCorrelation) carries correlationId=${JSON.stringify(bare.correlationId)} (expected null per AC-15102-3); de-claimed to conformanceOnly per the strict-evidence contract because no engine-returned identifier is available for a bare emission.`,
+      evidence: { bareLineCorrelationId: bare.correlationId, bodyExcerpt: JSON.stringify(bare).slice(0, 200) },
+    });
+  } finally {
+    await http.close();
+  }
+  return {
+    results,
+    extra: {
+      envDeclared: ['RCF_FIXTURE_LOGGER_CORRELATION_HEADER'],
+      headerName: HEADER,
+      port,
+      variedInputs: inputIds,
+      observedRoundTrips: observed,
+    },
+  };
+}

package/blueprints/observability-logging/contributions/probes/line-shape-and-fields.mjs

@@ -0,0 +1,82 @@
+// Line-shape probe for observability-logging.
+// Anchors AC-15101-1 (with the row extended to type-check each of the
+// shared minimum fields, so a numeric or object value cannot pass a
+// presence-only check), AC-15101-3 (BigInt-safe folding) and
+// AC-15101-4 (reserved-key collision safety).
+import { randomUUID } from 'node:crypto';
+import { createLogger, LEVEL_ORDER, runWithCorrelation } from '../../../../packages/rcf-lite/test/fixtures/probe-pack-observability-logging/src/logger-factory.mjs';
+
+export const anchorAcId = 'AC-15101-1';
+export const accountBound = false;
+const AC1 = 'A log emission at any level from any';
+const AC3 = 'A log emission whose payload contains a BigInt';
+const AC4 = 'The seven shared minimum fields (message, level, timestamp,';
+
+export default async function runProbe() {
+  const outBuf = []; const errBuf = [];
+  const clock = () => '2026-09-11T12:00:00.000Z';
+  const log = createLogger({ environment: 'qa', serviceName: 'probe-svc', serviceVersion: '0.0.1', minLevel: 'trace', outSink: (s) => outBuf.push(s), errSink: (s) => errBuf.push(s), clock });
+  const perLevelIds = [];
+  for (const lvl of LEVEL_ORDER) {
+    const cid = randomUUID();
+    perLevelIds.push({ level: lvl, correlationId: cid });
+    runWithCorrelation(cid, () => log[lvl](`hello-${lvl}`));
+  }
+  const lines = outBuf.join('').split('\n').filter(Boolean);
+  const required = ['message', 'level', 'timestamp', 'correlationId', 'environment', 'serviceName', 'serviceVersion'];
+  const results = [];
+  const parsed = [];
+  let allOk = lines.length === LEVEL_ORDER.length;
+  let typeFailures = [];
+  for (const ln of lines) {
+    let obj = null; let ok = true;
+    try { obj = JSON.parse(ln); } catch { ok = false; }
+    parsed.push(obj);
+    if (!ok) { allOk = false; continue; }
+    for (const k of required) {
+      if (!(k in obj)) { allOk = false; typeFailures.push({ key: k, reason: 'missing' }); continue; }
+      // correlationId is explicitly nullable when the emission has no
+      // ambient correlation context (AC-15102-3). Every other field
+      // must be a non-empty string.
+      if (k === 'correlationId') {
+        if (obj[k] !== null && (typeof obj[k] !== 'string' || obj[k].length === 0)) { allOk = false; typeFailures.push({ key: k, reason: `correlationId must be null or non-empty string (got ${typeof obj[k]})` }); }
+      } else if (typeof obj[k] !== 'string' || obj[k].length === 0) {
+        allOk = false; typeFailures.push({ key: k, reason: `not-non-empty-string (got ${typeof obj[k]})` });
+      }
+    }
+    // timestamp additionally must ISO-8601 parse.
+    if (typeof obj.timestamp === 'string' && Number.isNaN(Date.parse(obj.timestamp))) { allOk = false; typeFailures.push({ key: 'timestamp', reason: 'not ISO-8601 parseable' }); }
+  }
+  results.push({
+    anchorAcId: 'AC-15101-1',
+    verdict: allOk ? 'pass' : 'fail',
+    detail: `${AC1} call site  -  observed ${lines.length} lines on stdout; each JSON.parses and carries the seven minimum fields as non-empty strings (timestamp parses ISO-8601); expected=${LEVEL_ORDER.length}; typeFailures=${JSON.stringify(typeFailures)}.`,
+    evidence: { linesExcerpt: lines.slice(0, 3), levelsSeen: parsed.filter(Boolean).map((o) => o.level), typeFailures, observedEmissions: perLevelIds, suppliedInput: perLevelIds[0]?.correlationId, line: parsed[0] },
+  });
+  outBuf.length = 0; errBuf.length = 0;
+  const bigCid = randomUUID();
+  runWithCorrelation(bigCid, () => log.info('bigint', { id: 9007199254740993n }));
+  const bLines = outBuf.join('').split('\n').filter(Boolean);
+  let bParsed = null;
+  try { bParsed = JSON.parse(bLines[0]); } catch {}
+  results.push({
+    anchorAcId: 'AC-15101-3',
+    verdict: bParsed && bParsed.id === '9007199254740993' && errBuf.join('').length === 0 ? 'pass' : 'fail',
+    detail: `${AC3} value  -  observed BigInt folded to '${bParsed?.id}' on the emitted line; stderr='${errBuf.join('').trim()}'.`,
+    evidence: { line: bParsed, bodyExcerpt: bLines[0], suppliedInput: bigCid },
+  });
+  outBuf.length = 0; errBuf.length = 0;
+  const collCid = randomUUID();
+  runWithCorrelation(collCid, () => log.info('coll', { level: 'boom', timestamp: 'yesterday', custom: 'ok' }));
+  const cLine = outBuf.join('').split('\n').filter(Boolean)[0];
+  let cParsed = null;
+  try { cParsed = JSON.parse(cLine); } catch {}
+  const errCombined = errBuf.join('');
+  results.push({
+    anchorAcId: 'AC-15101-4',
+    verdict: cParsed?.level === 'info' && cParsed?.timestamp === '2026-09-11T12:00:00.000Z' && errCombined.includes("'level'") && errCombined.includes("'timestamp'") ? 'pass' : 'fail',
+    detail: `${AC4} correlationId,  -  observed factory-authored level=${cParsed?.level} timestamp=${cParsed?.timestamp}; stderr excerpt='${errCombined.trim()}' names the reserved keys.`,
+    evidence: { line: cParsed, bodyExcerpt: cLine, stderr: errCombined, suppliedInput: collCid },
+  });
+  return { results, extra: { envDeclared: ['RCF_FIXTURE_LOGGER_CORRELATION_HEADER'], capturedStdoutBytes: outBuf.reduce((n, s) => n + s.length, 0) } };
+}

package/blueprints/observability-logging/contributions/probes/probe-utils.mjs

@@ -0,0 +1,47 @@
+// Shared helpers for observability-logging probes.
+import { mkdir, writeFile } from 'node:fs/promises';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+export const PROJECT_ROOT = resolve(HERE, '..', '..', '..', '..');
+export const FIXTURE_DIR = resolve(PROJECT_ROOT, 'packages/rcf-lite/test/fixtures/probe-pack-observability-logging');
+export const REPORT_DIR = resolve(PROJECT_ROOT, '.rcf/reports/blueprints/observability-logging');
+export const DECLARED_ENV = new Set(['RCF_FIXTURE_LOGGER_CORRELATION_HEADER']);
+
+export function aggregate(results) {
+  if (!Array.isArray(results) || results.length === 0) return 'fail';
+  if (results.some((r) => r.verdict === 'fail')) return 'fail';
+  if (results.some((r) => r.verdict === 'warn')) return 'warn';
+  return 'pass';
+}
+export function isSkipped(results) { return Array.isArray(results) && results.length > 0 && results.every((r) => r.accountBoundSkipped === true); }
+export async function writeReport({ probeName, engine, results, extra }) {
+  await mkdir(REPORT_DIR, { recursive: true });
+  const normalised = (Array.isArray(results) && results.length > 0)
+    ? results
+    : [{ anchorAcId: null, harnessError: true, verdict: 'fail', detail: 'no checks ran', evidence: { reason: 'no checks ran', probeName, runAt: new Date().toISOString(), engine } }];
+  const raw = aggregate(normalised);
+  const aggregateVerdict = isSkipped(normalised) ? 'pass' : raw;
+  const report = { slug: 'observability-logging', probeName, runAt: new Date().toISOString(), engine, results: normalised, aggregateVerdict, ...(extra ?? {}) };
+  const path = resolve(REPORT_DIR, `${probeName}.json`);
+  await writeFile(path, JSON.stringify(report, null, 2) + '\n', 'utf8');
+  return { report, path };
+}
+export async function runShim(probeName, engine, mainFn) {
+  try {
+    const outcome = (await mainFn()) ?? { results: [] };
+    const { results, extra } = outcome;
+    const { report, path } = await writeReport({ probeName, engine, results, extra });
+    process.stdout.write(JSON.stringify(report, null, 2) + '\n');
+    process.stdout.write(`report written to ${path}\n`);
+    if (report.aggregateVerdict === 'fail') process.exitCode = 1;
+  } catch (err) {
+    const results = [{ anchorAcId: null, harnessError: true, verdict: 'fail', detail: `probe threw: ${err?.message ?? err}`, evidence: { thrown: true, message: err?.message ?? String(err), name: err?.name ?? 'Error', probeName, runAt: new Date().toISOString(), engine } }];
+    const { report, path } = await writeReport({ probeName, engine, results });
+    process.stdout.write(JSON.stringify(report, null, 2) + '\n');
+    process.stderr.write(`probe error: ${err?.stack ?? err}\n`);
+    process.stderr.write(`report written to ${path}\n`);
+    process.exitCode = 1;
+  }
+}

package/blueprints/observability-logging/contributions/probes/redaction-boundary.mjs

@@ -0,0 +1,130 @@
+// Redaction-boundary probe for observability-logging.
+//
+// Emits one payload per recommended-default category (credential,
+// token, bearer, pii.email, pii.name, pii.address) inside its own
+// runWithCorrelation(randomUUID(), ...) so each emission carries a
+// real, per-emission correlation id. For each category the probe
+// records the supplied correlation id, the emitted line's correlation
+// id (proving pairing on the wire), the redacted field value and the
+// caller-payload-unmutated observation - anchoring AC-15103-1 for
+// every one of the six mandatory categories the AC names.
+//
+// AC-15103-4 requires the SPECIFIC shape `{ user: { id: "u-1",
+// pii: { email: "a@b" } } }` with `user.id` PRESERVED and
+// `user.pii.email` redacted. That emission is a separate row anchored
+// on AC-15103-4, again with a per-emission correlation id paired to
+// the emitted line.
+//
+// AC-15103-3 (unrecognised category left unredacted) requires a
+// specifically-shaped `custom.internal.token`-style field name. A
+// bare `note` field does not exercise the "valid-but-unconfigured
+// kebab/dotted grammar" the AC names. Row de-claimed with the
+// limitation naming AC-15103-3.
+import { randomUUID } from 'node:crypto';
+import { createLogger, runWithCorrelation } from '../../../../packages/rcf-lite/test/fixtures/probe-pack-observability-logging/src/logger-factory.mjs';
+
+export const anchorAcId = 'AC-15103-1';
+export const accountBound = false;
+const AC1 = 'A log payload containing a field named or';
+const AC4 = 'The redaction boundary reads a nested payload path:';
+const AC3_LIM_NOTE = `AC-15103-3: requires a valid-but-unconfigured category name (kebab or dotted-namespace grammar), e.g. custom.internal.token, that looks like a redaction path but is not in defaults or additions. A bare field name 'note' with no category-shaped label does not exercise the AC's grammar constraint.`;
+
+function deepClone(v) { return JSON.parse(JSON.stringify(v)); }
+function sameShape(a, b) { return JSON.stringify(a) === JSON.stringify(b); }
+
+const CATEGORIES = [
+  { path: 'credential', build: () => ({ credential: 'SAMPLE_CRED_VALUE' }), read: (l) => l.credential, expected: '[REDACTED:credential]' },
+  { path: 'token', build: () => ({ token: 'SAMPLE_TOKEN_VALUE' }), read: (l) => l.token, expected: '[REDACTED:token]' },
+  { path: 'bearer', build: () => ({ bearer: 'SAMPLE_BEARER_VALUE' }), read: (l) => l.bearer, expected: '[REDACTED:bearer]' },
+  { path: 'pii.email', build: () => ({ pii: { email: 'sample@example.com' } }), read: (l) => l.pii?.email, expected: '[REDACTED:pii.email]' },
+  { path: 'pii.name', build: () => ({ pii: { name: 'Sample Person' } }), read: (l) => l.pii?.name, expected: '[REDACTED:pii.name]' },
+  { path: 'pii.address', build: () => ({ pii: { address: '1 Sample St' } }), read: (l) => l.pii?.address, expected: '[REDACTED:pii.address]' },
+];
+
+export default async function runProbe() {
+  const outBuf = [];
+  const log = createLogger({ environment: 'qa', serviceName: 'probe-svc', serviceVersion: '0.0.1', outSink: (s) => outBuf.push(s), errSink: () => {} });
+  const results = [];
+  const emittedCategoryLines = [];
+
+  for (const cat of CATEGORIES) {
+    outBuf.length = 0;
+    const payload = cat.build();
+    const beforePayload = deepClone(payload);
+    const supplied = randomUUID();
+    await runWithCorrelation(supplied, async () => { log.info(`redact-${cat.path}`, payload); });
+    const emitted = JSON.parse(outBuf.join('').split('\n').filter(Boolean)[0]);
+    emittedCategoryLines.push({ path: cat.path, supplied, emitted });
+    const got = cat.read(emitted);
+    const payloadUnmutated = sameShape(payload, beforePayload);
+    const paired = emitted.correlationId === supplied;
+    results.push({
+      anchorAcId: 'AC-15103-1',
+      verdict: got === cat.expected && payloadUnmutated && paired ? 'pass' : 'fail',
+      detail: `${AC1}  -  category '${cat.path}': supplied correlationId='${supplied}' -> emitted line.correlationId='${emitted.correlationId}' (paired=${paired}); field value on line='${got}' (expect '${cat.expected}'); caller payload unmutated=${payloadUnmutated}. Observes both AC-15103-1 clauses (redacted output AND caller object not mutated) for this category.`,
+      evidence: {
+        path: cat.path,
+        suppliedInput: supplied,
+        derivedResponseHeader: emitted.correlationId,
+        valueOnLine: got,
+        payloadUnmutated,
+        line: { correlationId: emitted.correlationId, level: emitted.level, message: emitted.message },
+        bodyExcerpt: JSON.stringify(emitted).slice(0, 300),
+      },
+    });
+  }
+
+  // AC-15103-3 negative-control: a plain 'note' field with no category
+  // grammar passes through unredacted. Emitted in its own correlation
+  // context but only observed against AC-15103-3 (which requires the
+  // dotted-namespace grammar this row does not exercise) so it stays
+  // de-claimed to conformanceOnly.
+  outBuf.length = 0;
+  const notePayload = { note: 'this stays' };
+  const noteSupplied = randomUUID();
+  await runWithCorrelation(noteSupplied, async () => { log.info('note-passthrough', notePayload); });
+  const noteLine = JSON.parse(outBuf.join('').split('\n').filter(Boolean)[0]);
+  results.push({
+    anchorAcId: null,
+    conformanceOnly: true,
+    limitation: AC3_LIM_NOTE,
+    verdict: noteLine.note === 'this stays' && noteLine.correlationId === noteSupplied ? 'pass' : 'fail',
+    detail: `observed negative-control top-level field 'note'='${noteLine.note}' (no category tag at all -- passes through unredacted); supplied correlationId='${noteSupplied}' -> emitted line.correlationId='${noteLine.correlationId}'.`,
+    evidence: { note: noteLine.note, valueOnLine: noteLine.note, line: { correlationId: noteLine.correlationId, level: noteLine.level, message: noteLine.message, note: noteLine.note } },
+  });
+
+  // AC-15103-4-shaped emission: { user: { id: 'u-1', pii: { email: 'a@b' } } }.
+  outBuf.length = 0;
+  const acShapedPayload = { user: { id: 'u-1', pii: { email: 'a@b' } } };
+  const acShapedBefore = deepClone(acShapedPayload);
+  const acShapedSupplied = randomUUID();
+  await runWithCorrelation(acShapedSupplied, async () => { log.info('ac-15103-4-shape', acShapedPayload); });
+  const acShapedUnmutated = sameShape(acShapedPayload, acShapedBefore);
+  const acShapedLine = JSON.parse(outBuf.join('').split('\n').filter(Boolean)[0]);
+  const emailRedactedOk = acShapedLine.user?.pii?.email === '[REDACTED:pii.email]';
+  const idPreservedOk = acShapedLine.user?.id === 'u-1';
+  const acShapedPaired = acShapedLine.correlationId === acShapedSupplied;
+  results.push({
+    anchorAcId: 'AC-15103-4',
+    verdict: emailRedactedOk && idPreservedOk && acShapedUnmutated && acShapedPaired ? 'pass' : 'fail',
+    detail: `${AC4}  -  observed emitted line with payload { user: { id: 'u-1', pii: { email: 'a@b' } } }: user.id='${acShapedLine.user?.id}' (expect 'u-1' PRESERVED); user.pii.email='${acShapedLine.user?.pii?.email}' (expect '[REDACTED:pii.email]'); acShapedPayload unmutated=${acShapedUnmutated}; supplied correlationId='${acShapedSupplied}' -> emitted line.correlationId='${acShapedLine.correlationId}' (paired=${acShapedPaired}).`,
+    evidence: {
+      suppliedInput: acShapedSupplied,
+      derivedResponseHeader: acShapedLine.correlationId,
+      userIdOnLine: acShapedLine.user?.id,
+      userPiiEmailOnLine: acShapedLine.user?.pii?.email,
+      acShapedUnmutated,
+      line: { correlationId: acShapedLine.correlationId, level: acShapedLine.level, message: acShapedLine.message, user: acShapedLine.user },
+    },
+  });
+
+  return {
+    results,
+    extra: {
+      envDeclared: ['RCF_FIXTURE_LOGGER_CORRELATION_HEADER'],
+      categoriesObserved: emittedCategoryLines.map((c) => ({ path: c.path, supplied: c.supplied, emittedCorrelationId: c.emitted.correlationId, valueOnLine: c.path.includes('.') ? c.emitted.pii?.[c.path.split('.')[1]] : c.emitted[c.path] })),
+      acShapedExcerpt: acShapedLine,
+      acShapedUnmutated,
+    },
+  };
+}

package/blueprints/observability-logging/contributions/probes/run-correlation-id-flow.mjs

@@ -0,0 +1,3 @@
+import runProbe from './correlation-id-flow.mjs';
+import { runShim } from './probe-utils.mjs';
+runShim('correlation-id-flow', { kind: 'logger', driver: 'in-process fixture logger factory (Node 24)', healthy: true }, runProbe);

package/blueprints/observability-logging/contributions/probes/run-line-shape-and-fields.mjs

@@ -0,0 +1,3 @@
+import runProbe from './line-shape-and-fields.mjs';
+import { runShim } from './probe-utils.mjs';
+runShim('line-shape-and-fields', { kind: 'logger', driver: 'in-process fixture logger factory (Node 24)', healthy: true }, runProbe);

package/blueprints/observability-logging/contributions/probes/run-redaction-boundary.mjs

@@ -0,0 +1,3 @@
+import runProbe from './redaction-boundary.mjs';
+import { runShim } from './probe-utils.mjs';
+runShim('redaction-boundary', { kind: 'logger', driver: 'in-process fixture logger factory (Node 24)', healthy: true }, runProbe);

package/blueprints/observability-probe-endpoints/CHANGELOG.md

@@ -1,17 +1,32 @@
+# Changelog
+
+## 1.2.5 - 2026-09-11
+
+Anatomy suite tracks the strengthened shared helper (WARN-only shortcut removed, log objects and content lists no longer identifiers, retained anchor existence check). No probe changes required.
+
+## 1.2.4 - 2026-09-11
+
+shared anatomy helper tightened; probe-endpoints anatomy test passes shippedAcIds and browserOnlyAcIds into the helper and additionally checks every accountBoundSkipped row names exactly one declared env variable.
+
 # observability-probe-endpoints CHANGELOG
 
+## 1.2.3 - 2026-09-11
+
+Adds a contributions/probes/ pack (profile-boot-materialisation, kubernetes-startup-enabled, partial-profile-refusal) with a fixture-side profile registry and HTTP materialiser under packages/rcf-lite/test/fixtures/probe-pack-observability-probe-endpoints/. Probes run against the fixture on Node 24. No account gate.
+
+Anchoring: kubernetes-startup-enabled anchors AC-14102-4 with BOTH the enabled clause (three-path resolution; pre-ready GET /startup answers HTTP 503 body.status='fail'; post-markStartupReady GET answers HTTP 200 body.status='pass') AND the disabled clause (no enable flag: resolver returns two paths, GET /startup returns 404 with no /startup handler registered). profile-boot-materialisation observes bound-path behaviour for /live and /ready under the shipped kubernetes profile; the row de-claims (conformanceOnly, anchorAcId=null) with the limitation naming AC-14101-1 (port topology and handler-absence not observed). partial-profile-refusal observes an in-process refuseIfPartial refusal (stripped transport; startupEnabled without paths.startup) with the row de-claiming AC-14103-2 (process-level non-zero exit not observed at shelf); the shape presence check for the six shipped profiles de-claims AC-14103-1 (enum-membership per field not observed); the loadBalancer profile shape row de-claims AC-14103-3 (profile is not materialised and probed for handler absence). probe-utils normalisation and thrown-error rows carry an evidence object; the fallback anchorAcId is null.
+
 ## 1.2.1 (register-sweep patch, 2026-09-10)
 
 - Register: neutral wording in shipped prose (no capability change).
 
-## 1.2.0 (hardening pass, 2026-09-09)
+## 1.2.0 (2026-09-09)
 
 - Adds `elicits[]` with four apply-time answers: `probe-interface-profile` (enum kubernetes/loadBalancer/uptimeMonitor/systemd/dockerHealthcheck/reverseProxy/custom, default kubernetes; REQ-001), `probe-paths-override` (string JSON; REQ-002/003), `probe-listener-separate-port` (string; REQ-004), `kubernetes-startup-enabled` (enum off/on, default off; ADR-1503). Every option value is backed by a must-priority REQ description.
-- Adds `deliveredBy` to every REQ (REQ-001-008 -> TAC-1501/1502/1503/1504 interface names; REQ-006 -> ADR-1505). Closes 7 pass-2 lint findings.
-- Closes F-1 chain-contradiction specimen: settles missing-profile semantics as fallback-to-Kubernetes-default (per ADR-1503), not refuse. REQ-001 rewritten to name precedence (explicit declaration wins, absent falls back, unknown/malformed refused with stable codes PROBE_PROFILE_UNKNOWN / PROBE_PROFILE_MALFORMED). AC-14101-2 rebased to the fallback path; AC-14101-4 added for malformed.
-- Closes F-3 (liveness failure without AC coverage): adds AC-14102-5 asserting a response-capable in-process liveness self-check predicate answers HTTP 503 with content-length 0 on fail; `template` because the predicate is project-owned.
-- Closes F-4 chain-contradiction specimen: rewrites the guide's `Boundary with observability-essentials` section to the current-shelf reality (essentials v2 dropped its `scope: global` claims on `healthProbes` and `readinessSemantics`; probe-endpoints is the sole claimant on both topics; both orders compose cleanly). The pre-v2 conflict-resolution paths move to a historical migration note.
-- Closes F-2 (systemd + TCP transport families with no AC): adds AC-14105-4 (systemd Type=notify: exactly-once READY=1 plus periodic WATCHDOG=1 at cadence; supervisor pull when the watchdog cadence lapses), AC-14105-5 (TCP transport: accept on pass, refuse on fail, zero bytes on the connection), AC-14105-6 (missing platform adapter refused at boot with PROBE_ADAPTER_MISSING).
-- Closes the pass-1 lint finding on AC-14106-3: `then` now uses the canonical lowercase `content-length` string owned by TAC-1502.responsibilities[2].
+- Adds `deliveredBy` to every REQ (REQ-001-008 -> TAC-1501/1502/1503/1504 interface names; REQ-006 -> ADR-1505).
+- Missing-profile semantics settle as fallback-to-Kubernetes-default (per ADR-1503), not refuse. REQ-001 names precedence (explicit declaration wins, absent falls back, unknown/malformed refused with stable codes PROBE_PROFILE_UNKNOWN / PROBE_PROFILE_MALFORMED). AC-14101-2 is on the fallback path; AC-14101-4 covers malformed.
+- The liveness failure without AC coverage gap is fixed: adds AC-14102-5 asserting a response-capable in-process liveness self-check predicate answers HTTP 503 with content-length 0 on fail; `template` because the predicate is project-owned.
+- The guide's `Boundary with observability-essentials` section reflects the current shelf: essentials v2 dropped its `scope: global` claims on `healthProbes` and `readinessSemantics`; probe-endpoints is the sole claimant on both topics; both orders compose cleanly. The pre-v2 conflict-resolution paths move to a historical migration note.
+- The systemd + TCP transport families with no AC gap is fixed: adds AC-14105-4 (systemd Type=notify: exactly-once READY=1 plus periodic WATCHDOG=1 at cadence; supervisor pull when the watchdog cadence lapses), AC-14105-5 (TCP transport: accept on pass, refuse on fail, zero bytes on the connection), AC-14105-6 (missing platform adapter refused at boot with PROBE_ADAPTER_MISSING).
+- Adds the missing coverage on AC-14106-3: `then` now uses the canonical lowercase `content-length` string owned by TAC-1502.responsibilities[2].
 - Re-sweeps every existing AC's `disposition` per section 7b: ACs whose text references profile names, dependency names, or the elicited separate-port option flipped to `template` with `templateFillIns`; the remaining ACs stay `fixed`.
-- Review fix pass (register scan): the band-spacing paragraph in `docs/topics.md` reads `shelf-lane`/`shelf lane` so shipped content carries no internal team labels.

package/blueprints/observability-probe-endpoints/README.md

@@ -29,9 +29,9 @@ The doc set is contributions (copied into the project tree by `rcf define bluepr
 
 ## What it contributes, and what it deliberately does not
 
-Contributed kinds: REQ, US (with inline ACs), TAC, ADR. Adherence is expressed as ACs; the blueprint ships no test files (ratified decision 5) and no code.
+Contributed kinds: REQ, US (with inline ACs), TAC, ADR. Adherence is expressed as ACs; the blueprint ships no test files (shipped policy 5) and no code.
 
-No FBS contributions, as a matter of principle (ratified policy 2026-08-19): FBSs are the work of the implementing agent, not the blueprint; project constraints have to be applied at the time of creation. The blueprint contributes the WHAT (the elicitation surface, the six shipped profile contracts, the two-listener topology option, the auth-exempt-list emission, the response-contract secrecy rule, the profile-swap-is-config invariant); the implementing agent derives the HOW-tasks (FBS) in the host project, where the ACs contributed here get picked up by the project's own build sequencing.
+No FBS contributions, as a matter of principle (policy): FBSs are the work of the implementing agent, not the blueprint; project constraints have to be applied at the time of creation. The blueprint contributes the WHAT (the elicitation surface, the six shipped profile contracts, the two-listener topology option, the auth-exempt-list emission, the response-contract secrecy rule, the profile-swap-is-config invariant); the implementing agent derives the HOW-tasks (FBS) in the host project, where the ACs contributed here get picked up by the project's own build sequencing.
 
 Deliberately not contributed: a public status page (observability-essentials owns `statusPageContract` for that audience); a notification outcome sink (observability-essentials owns that); an authenticated operator dashboard for granular internal state (project-authored on top of the readiness predicate); a metrics-export surface (a future `metrics-export` blueprint composes alongside); a distributed-tracing surface (a future `tracing` blueprint composes alongside); a log-shipping surface (application-api-rest's `logging` topic governs the wire-log shape of the HTTP tier); the readiness predicate implementation itself (project-authored; the blueprint fixes the boundary and each profile's default aggregation rule, not the per-dependency check code); the auth middleware installer (project-authored; the blueprint emits an exact-match exempt list the installer consumes); the vendor-CLI or client-library binding for any supervisor beyond the profile contract (project-authored inside a `custom:<name>` profile).
 
@@ -49,7 +49,7 @@ The probe surface always follows the operator-declared target integration profil
 
 ## Known mechanism-reach gaps
 
-- **Custom-profile contract adherence.** Projects that author a `custom:<name>` profile against the profile contract are expected to satisfy the same transport/paths/responseContract/semanticModel shape the shipped profiles do; the profile contract validator (TAC-1501) refuses a partial profile at boot, which is where the mechanism reach lands. What the validator cannot compel is that a project-authored custom profile's response shape is minimal in the AC-14105 and AC-14106 sense (a custom profile could in principle enumerate a rich field set the validator would accept as complete). Recorded here rather than smuggled in as an AC that would only apply to the shipped profiles. Promotion signal: a `custom-profile-shape-lint` addition to the profile contract validator that enforces the minimalism rule per field-set-size heuristic (harder than it sounds; some legitimate custom profiles do have wider fields); or a project-side grep gate. Project-side workaround until then: reviewers of a `custom:<name>` profile eyeball the enumerated field set against the pattern the shipped six carry.
+- **Custom-profile contract adherence.** Projects that author a `custom:<name>` profile against the profile contract are expected to satisfy the same transport/paths/responseContract/semanticModel shape the shipped profiles do; the profile contract validator (TAC-1501) refuses a partial profile at boot, which is where the mechanism reach lands. What the validator cannot compel is that a project-authored custom profile's response shape is minimal in the AC-14105 and AC-14106 sense (a custom profile could in principle enumerate a rich field set the validator would accept as complete). Recorded here rather than smuggled in as an AC that would only apply to the shipped profiles. Promotion signal: a `custom-profile-shape-lint` addition to the profile contract validator that enforces the minimalism rule per field-set-size heuristic (harder than it sounds; some legitimate custom profiles do have wider fields); or a project-side grep gate. Project-side workaround until then: at project-side check, compare the custom profile's enumerated field set against the pattern the shipped six carry.
 - **Kubernetes gRPC probe transport.** The `kubernetes` profile ships HTTPGet and TCPSocket transports (via TAC-1504's tcpAdapter selection) but not gRPC. A project on a gRPC-only mesh that wants the standard gRPC health protocol supersedes ADR-1503 with a project-level ADR selecting the gRPC transport, or authors a `custom:kubernetes-grpc` profile. Promotion signal: a shipped gRPC-transport handler in a v1.1 pass if enough rcf-lite projects reach for it. Project-side workaround: the `custom:<name>` slot is the mechanism escape hatch.
 
 ## Optional startup path (v1.1.0)

package/blueprints/observability-probe-endpoints/blueprint.json

@@ -1,6 +1,6 @@
 {
   "slug": "observability-probe-endpoints",
-  "version": "1.2.1",
+  "version": "1.2.5",
   "category": "observability",
   "elicits": [
     {
@@ -171,5 +171,6 @@
       "kind": "adr",
       "path": "adrs/adr-1505-observability-probe-endpoints-external-response-secrecy.json"
     }
-  ]
+  ],
+  "updatedAt": "2026-09-11"
 }

package/blueprints/observability-probe-endpoints/contributions/probes/kubernetes-startup-enabled.mjs

@@ -0,0 +1,80 @@
+// Kubernetes-startup-enabled probe for observability-probe-endpoints.
+//
+// Anchors AC-14102-4. The AC has two clauses:
+//   - enabled: probeInterface.options.kubernetes.startup.enabled=true
+//     -> resolver returns a three-path set including /startup; first
+//     GET on /startup returns 503 body {status:fail}; a second GET
+//     after the predicate returns pass returns 200 body {status:pass}.
+//   - disabled (without the enable flag): resolver returns two paths
+//     and no /startup handler is registered.
+// This probe exercises BOTH clauses.
+
+import { randomUUID } from 'node:crypto';
+import { materialise, resolveProfile } from '../../../../packages/rcf-lite/test/fixtures/probe-pack-observability-probe-endpoints/src/profile-registry.mjs';
+import { primaryPort } from './probe-utils.mjs';
+
+export const anchorAcId = 'AC-14102-4';
+export const accountBound = false;
+const AC4 = 'When the operator sets probeInterface.options.kubernetes.startup.enabled: true on the';
+
+async function get(url, rid) {
+  const res = await fetch(url, { headers: { 'x-request-id': rid } });
+  const text = await res.text();
+  let parsed = null; try { parsed = JSON.parse(text); } catch {}
+  return { status: res.status, requestId: res.headers.get('x-request-id'), body: text, parsed };
+}
+
+export default async function runProbe() {
+  const results = [];
+
+  // ENABLED clause
+  const resolvedEnabled = resolveProfile('kubernetes', { startup: { enabled: true } });
+  const enabledPathCount = Object.keys(resolvedEnabled.paths ?? {}).length;
+  const enabledHasStartup = Boolean(resolvedEnabled.paths?.startup);
+  const inst = await materialise({ profile: resolvedEnabled, listenerPort: primaryPort() });
+  const suppliedStarting = randomUUID();
+  const suppliedReady = randomUUID();
+  let starting, ready;
+  try {
+    starting = await get(`http://127.0.0.1:${inst.requestPort}/startup`, suppliedStarting);
+    results.push({
+      anchorAcId: 'AC-14102-4',
+      verdict: enabledPathCount === 3 && enabledHasStartup && starting.status === 503 && starting.requestId === suppliedStarting && starting.parsed?.status === 'fail' && starting.parsed?.profile === 'kubernetes' ? 'pass' : 'fail',
+      detail: `${AC4} shipped kubernetes profile  -  ENABLED clause: paths=${JSON.stringify(Object.keys(resolvedEnabled.paths ?? {}))} startup path='${resolvedEnabled.paths?.startup}'; pre-ready GET /startup -> ${starting.status} body.status='${starting.parsed?.status}'; echoed requestId=${starting.requestId === suppliedStarting}.`,
+      evidence: { variedInput: suppliedStarting, suppliedInput: suppliedStarting, derived: { status: starting.status, requestId: starting.requestId, bodyExcerpt: starting.body.slice(0, 300) }, derivedStarting: { status: starting.status, requestId: starting.requestId, bodyExcerpt: starting.body.slice(0, 300) } },
+    });
+    inst.markStartupReady();
+    ready = await get(`http://127.0.0.1:${inst.requestPort}/startup`, suppliedReady);
+    results.push({
+      anchorAcId: 'AC-14102-4',
+      verdict: ready.status === 200 && ready.requestId === suppliedReady && ready.parsed?.status === 'pass' && ready.parsed?.profile === 'kubernetes' ? 'pass' : 'fail',
+      detail: `${AC4} shipped kubernetes profile  -  ENABLED clause: post-markStartupReady GET /startup -> ${ready.status} body.status='${ready.parsed?.status}'; echoed requestId=${ready.requestId === suppliedReady}.`,
+      evidence: { variedInput: suppliedReady, suppliedInput: suppliedReady, derived: { status: ready.status, requestId: ready.requestId, bodyExcerpt: ready.body.slice(0, 300) }, derivedReady: { status: ready.status, requestId: ready.requestId, bodyExcerpt: ready.body.slice(0, 300) } },
+    });
+  } finally { await inst.close(); }
+
+  // DISABLED clause: no enable flag; resolver must yield two paths and
+  // /startup must be a 404 (no handler registered).
+  const resolvedDisabled = resolveProfile('kubernetes');
+  const disabledPathCount = Object.keys(resolvedDisabled.paths ?? {}).length;
+  const disabledHasStartup = Boolean(resolvedDisabled.paths?.startup);
+  const inst2 = await materialise({ profile: resolvedDisabled, listenerPort: primaryPort() });
+  let disabledResp;
+  const disabledId = randomUUID();
+  try {
+    disabledResp = await get(`http://127.0.0.1:${inst2.requestPort}/startup`, disabledId);
+    results.push({
+      anchorAcId: 'AC-14102-4',
+      verdict: disabledPathCount === 2 && !disabledHasStartup && disabledResp.status === 404 ? 'pass' : 'fail',
+      detail: `${AC4} shipped kubernetes profile  -  DISABLED clause (no enable flag): paths=${JSON.stringify(Object.keys(resolvedDisabled.paths ?? {}))} (expect two paths); GET /startup -> ${disabledResp.status} (expect 404 with no /startup handler registered).`,
+      evidence: { variedInput: disabledId, suppliedInput: disabledId, derived: { status: disabledResp.status, requestId: disabledResp.requestId, bodyExcerpt: disabledResp.body.slice(0, 300) }, resolvedPaths: resolvedDisabled.paths, acceptedProfile: resolvedDisabled.name },
+    });
+  } finally { await inst2.close(); }
+
+  return { results, extra: { envDeclared: ['RCF_FIXTURE_OBS_PROBE_PORT', 'RCF_FIXTURE_OBS_PROBE_SEPARATE_PORT'], boundPort: inst.requestPort,
+    variedInputs: { starting: suppliedStarting, ready: suppliedReady, disabled: disabledId },
+    derivedStarting: starting && { status: starting.status, requestId: starting.requestId, bodyExcerpt: starting.body.slice(0, 300) },
+    derivedReady: ready && { status: ready.status, requestId: ready.requestId, bodyExcerpt: ready.body.slice(0, 300) },
+    derivedDisabled: disabledResp && { status: disabledResp.status, requestId: disabledResp.requestId, bodyExcerpt: disabledResp.body.slice(0, 300) },
+  } };
+}