rcf-lite 0.27.0 → 0.28.0

package/blueprints/application-api-rest/contributions/probes/cursor-pagination-round-trip.mjs

@@ -0,0 +1,154 @@
+// cursor-pagination-round-trip probe for application-api-rest v2.1.10.
+//
+// AC-2109-1 envelope, AC-2109-2 traversal, AC-2109-3 opacity and
+// malformed cursor, AC-2109-5 declared max limit enforcement.
+//
+// anchorAcId: per-row.
+
+import { startFixture, evidenceFromResponse } from './probe-utils.mjs';
+
+export const anchorReqId = 'application-api-rest-REQ-007';
+export const accountBound = false;
+
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+
+export default async function runProbe() {
+  const { startServer } = await import('../../../../packages/rcf-lite/test/fixtures/probe-pack-application-api-rest/server.js');
+  const fixture = await startFixture({ startServer, port: 0 });
+  try {
+    const results = [];
+
+    // Row 1 (AC-2109-1): first-page envelope carries items, next, prev.
+    const firstRes = await fetch(`${fixture.baseUrl}/v1/widgets?limit=5`);
+    const firstBody = await firstRes.text();
+    const first = JSON.parse(firstBody);
+    const envelopeOk = Array.isArray(first.items)
+      && first.items.length === 5
+      && typeof first.next === 'string'
+      && first.prev === null;
+    results.push({
+      anchorAcId: 'application-api-rest-AC-2109-1',
+      verdict: firstRes.status === 200 && envelopeOk ? 'pass' : 'fail',
+      detail: `Every collection endpoint accepts ?cursor= and ?limit= and - GET /v1/widgets?limit=5 returned items[${first.items?.length ?? 0}] next=${typeof first.next}(${(first.next || '').slice(0, 12)}...) prev=${first.prev}`,
+      evidence: evidenceFromResponse({
+        route: '/v1/widgets?limit=5',
+        response: firstRes,
+        bodyText: firstBody,
+        extraFields: {
+          input: { limit: 5, cursor: null },
+          derived: { itemsLen: first.items?.length ?? 0, next: first.next, prev: first.prev, firstIds: (first.items || []).map((i) => i.id) },
+        },
+      }),
+    });
+
+    // Row 2 (AC-2109-2): traversal visits every item exactly once and next is null on the last page.
+    const visited = new Set();
+    let dupes = 0;
+    for (const it of first.items) { if (visited.has(it.id)) dupes += 1; visited.add(it.id); }
+    let cursor = first.next;
+    let pages = 0;
+    let last = first, lastRes = firstRes, lastBody = firstBody;
+    while (cursor && pages < 20) {
+      const r = await fetch(`${fixture.baseUrl}/v1/widgets?limit=5&cursor=${encodeURIComponent(cursor)}`);
+      const b = await r.text();
+      const p = JSON.parse(b);
+      for (const it of (p.items || [])) { if (visited.has(it.id)) dupes += 1; visited.add(it.id); }
+      last = p; lastRes = r; lastBody = b; cursor = p.next; pages += 1;
+    }
+    const traversalOk = last.next === null && dupes === 0 && visited.size === 12;
+    results.push({
+      anchorAcId: 'application-api-rest-AC-2109-2',
+      verdict: traversalOk ? 'pass' : 'fail',
+      detail: `next is null on the last page and - traversal via next visited ${visited.size} unique items over ${pages + 1} pages, dupes=${dupes}, final next=${last.next}`,
+      evidence: evidenceFromResponse({
+        route: '/v1/widgets (traversal tail)',
+        response: lastRes,
+        bodyText: lastBody,
+        extraFields: {
+          input: { limit: 5, followFromCursor: first.next },
+          derived: { uniqueVisited: visited.size, dupes, finalNext: last.next, pages: pages + 1 },
+        },
+      }),
+    });
+
+    // Row 3 (AC-2109-3 opacity): the emitted token is not a decodable
+    // positional marker. It is an opaque UUID; base64url decode is not
+    // parseable as JSON and any positional info the client tries to
+    // recover fails.
+    const cursorStr = first.next;
+    const numericFallback = Number.parseInt(cursorStr, 10);
+    const parseableAsInt = Number.isFinite(numericFallback) && String(numericFallback) === cursorStr;
+    let base64JsonReadable = false;
+    try {
+      const decoded = Buffer.from(cursorStr, 'base64url').toString('utf8');
+      const parsed = JSON.parse(decoded);
+      if (parsed && typeof parsed === 'object') base64JsonReadable = true;
+    } catch { base64JsonReadable = false; }
+    const looksLikeUuid = UUID_RE.test(cursorStr);
+    const opaque = !parseableAsInt && !base64JsonReadable;
+    results.push({
+      anchorAcId: 'application-api-rest-AC-2109-3',
+      verdict: opaque ? 'pass' : 'fail',
+      detail: `Cursors are opaque: they carry no client-decodable positional - cursor "${cursorStr}" parseableAsInt=${parseableAsInt} base64UrlJsonReadable=${base64JsonReadable} looksLikeUuid=${looksLikeUuid}`,
+      evidence: evidenceFromResponse({
+        route: '/v1/widgets?limit=5',
+        response: firstRes,
+        bodyText: firstBody,
+        extraFields: {
+          input: { cursor: cursorStr },
+          derived: { parseableAsInt, base64UrlJsonReadable: base64JsonReadable, looksLikeUuid, opaque },
+        },
+      }),
+    });
+
+    // Row 4 (AC-2109-3 malformed cursor -> problem+json).
+    const malformedRes = await fetch(`${fixture.baseUrl}/v1/widgets?limit=5&cursor=not-a-cursor`);
+    const malformedBody = await malformedRes.text();
+    let malformedJson = null;
+    try { malformedJson = JSON.parse(malformedBody); } catch {}
+    const malformedOk = malformedRes.status === 400
+      && (malformedRes.headers.get('content-type') || '').includes('application/problem+json')
+      && malformedJson && malformedJson.type && malformedJson.type.includes('cursor-invalid');
+    results.push({
+      anchorAcId: 'application-api-rest-AC-2109-3',
+      verdict: malformedOk ? 'pass' : 'fail',
+      detail: `Cursors are opaque: they carry no client-decodable positional - malformed cursor "not-a-cursor" returned ${malformedRes.status} problem+json type=${malformedJson?.type ?? 'null'}`,
+      evidence: evidenceFromResponse({
+        route: '/v1/widgets?cursor=not-a-cursor',
+        response: malformedRes,
+        bodyText: malformedBody,
+        extraFields: {
+          input: { cursor: 'not-a-cursor' },
+          derived: { httpStatus: malformedRes.status, problemType: malformedJson?.type ?? null },
+        },
+      }),
+    });
+
+    // Row 5 (AC-2109-5 max-limit -> problem+json).
+    const overLimitRes = await fetch(`${fixture.baseUrl}/v1/widgets?limit=999`);
+    const overLimitBody = await overLimitRes.text();
+    let overLimitJson = null;
+    try { overLimitJson = JSON.parse(overLimitBody); } catch {}
+    const overLimitOk = overLimitRes.status === 400
+      && (overLimitRes.headers.get('content-type') || '').includes('application/problem+json')
+      && overLimitJson && overLimitJson.type && overLimitJson.type.includes('limit-exceeded');
+    results.push({
+      anchorAcId: 'application-api-rest-AC-2109-5',
+      verdict: overLimitOk ? 'pass' : 'fail',
+      detail: `The declared maximum limit is enforced: a request - ?limit=999 returned ${overLimitRes.status} problem+json type=${overLimitJson?.type ?? 'null'}`,
+      evidence: evidenceFromResponse({
+        route: '/v1/widgets?limit=999',
+        response: overLimitRes,
+        bodyText: overLimitBody,
+        extraFields: {
+          input: { limit: 999 },
+          derived: { httpStatus: overLimitRes.status, problemType: overLimitJson?.type ?? null },
+        },
+      }),
+    });
+
+    return { results };
+  } finally {
+    await fixture.close();
+  }
+}

package/blueprints/application-api-rest/contributions/probes/health-probes-distinct.mjs

@@ -0,0 +1,124 @@
+// health-probes-distinct probe for application-api-rest v2.1.10.
+//
+// AC-2108-1: liveness returns 200 with no dependency checks whatsoever.
+// AC-2108-2: readiness returns 200 only when every declared check passes.
+// AC-2108-4: startup returns 200 only after initialisation completes.
+//
+// anchorAcId: per-row.
+
+import { startFixture, evidenceFromResponse } from './probe-utils.mjs';
+
+export const anchorReqId = 'application-api-rest-REQ-006';
+export const accountBound = false;
+
+export default async function runProbe() {
+  const { startServer } = await import('../../../../packages/rcf-lite/test/fixtures/probe-pack-application-api-rest/server.js');
+  const fixture = await startFixture({ startServer, port: 0 });
+  try {
+    const results = [];
+
+    // AC-2108-1: liveness is 200 regardless of dependency availability.
+    // The derivation is that varying ?deps= does NOT change the returned
+    // status, and the response records dependencyChecksPerformed=0.
+    const liveUp = await fetch(`${fixture.baseUrl}/livez?deps=up`);
+    const liveUpBody = await liveUp.text();
+    const liveUpJson = JSON.parse(liveUpBody);
+    const liveDown = await fetch(`${fixture.baseUrl}/livez?deps=down`);
+    const liveDownBody = await liveDown.text();
+    const liveDownJson = JSON.parse(liveDownBody);
+    const liveUnknown = await fetch(`${fixture.baseUrl}/livez?deps=unknown`);
+    const liveUnknownBody = await liveUnknown.text();
+    const liveUnknownJson = JSON.parse(liveUnknownBody);
+    const allTwoHundred = liveUp.status === 200 && liveDown.status === 200 && liveUnknown.status === 200;
+    const noDepsChecked = liveUpJson.dependencyChecksPerformed === 0
+      && liveDownJson.dependencyChecksPerformed === 0
+      && liveUnknownJson.dependencyChecksPerformed === 0;
+    const livenessOk = allTwoHundred && noDepsChecked;
+    results.push({
+      anchorAcId: 'application-api-rest-AC-2108-1',
+      verdict: livenessOk ? 'pass' : 'fail',
+      detail: `GET on the resolved liveness path returns 200 - /livez returned ${liveUp.status}/${liveDown.status}/${liveUnknown.status} across ?deps=up|down|unknown; dependencyChecksPerformed reported ${liveUpJson.dependencyChecksPerformed}/${liveDownJson.dependencyChecksPerformed}/${liveUnknownJson.dependencyChecksPerformed}`,
+      evidence: evidenceFromResponse({
+        route: '/livez?deps=down',
+        response: liveDown,
+        bodyText: liveDownBody,
+        extraFields: {
+          input: { depsSequence: ['up', 'down', 'unknown'] },
+          derived: {
+            statuses: [liveUp.status, liveDown.status, liveUnknown.status],
+            dependencyChecksPerformed: [liveUpJson.dependencyChecksPerformed, liveDownJson.dependencyChecksPerformed, liveUnknownJson.dependencyChecksPerformed],
+            unaffectedByDependencyOutage: livenessOk,
+          },
+          altBodyExcerpt: liveUpBody.slice(0, 240),
+        },
+      }),
+    });
+
+    // AC-2108-2: readiness returns 200 only when every declared check passes.
+    const readyUp = await fetch(`${fixture.baseUrl}/readyz?deps=up`);
+    const readyUpBody = await readyUp.text();
+    const readyUpJson = JSON.parse(readyUpBody);
+    const readyDown = await fetch(`${fixture.baseUrl}/readyz?deps=down`);
+    const readyDownBody = await readyDown.text();
+    const readyDownJson = JSON.parse(readyDownBody);
+    const readinessAllChecked = Array.isArray(readyUpJson.checks) && readyUpJson.checks.every((c) => c.ok === true);
+    const readinessDownDetected = readyDown.status === 503 && readyDownJson.checks.some((c) => c.ok === false);
+    const readinessDerived = readyUp.status === 200 && readinessAllChecked && readinessDownDetected;
+    results.push({
+      anchorAcId: 'application-api-rest-AC-2108-2',
+      verdict: readinessDerived ? 'pass' : 'fail',
+      detail: `GET on the resolved readiness path returns 200 - /readyz enumerates ${readyUpJson.checks?.length ?? 0} declared checks; all pass in up-state (${readyUp.status}), at least one down in down-state (${readyDown.status})`,
+      evidence: evidenceFromResponse({
+        route: '/readyz?deps=up',
+        response: readyUp,
+        bodyText: readyUpBody,
+        extraFields: {
+          input: { depsSequence: ['up', 'down'] },
+          derived: {
+            checksInUp: readyUpJson.checks,
+            checksInDown: readyDownJson.checks,
+            upStatus: readyUp.status,
+            downStatus: readyDown.status,
+          },
+          altBodyExcerpt: readyDownBody.slice(0, 240),
+        },
+      }),
+    });
+
+    // AC-2108-4: startup returns 200 only after initialisation completes.
+    const startupInit = await fetch(`${fixture.baseUrl}/startupz?state=init`);
+    const startupInitBody = await startupInit.text();
+    const startupInitJson = JSON.parse(startupInitBody);
+    const startupComplete = await fetch(`${fixture.baseUrl}/startupz?state=complete`);
+    const startupCompleteBody = await startupComplete.text();
+    const startupCompleteJson = JSON.parse(startupCompleteBody);
+    const startupDerived = startupInit.status === 503
+      && Array.isArray(startupInitJson.pending) && startupInitJson.pending.length > 0
+      && startupComplete.status === 200
+      && Array.isArray(startupCompleteJson.pending) && startupCompleteJson.pending.length === 0;
+    results.push({
+      anchorAcId: 'application-api-rest-AC-2108-4',
+      verdict: startupDerived ? 'pass' : 'fail',
+      detail: `GET on the resolved startup path returns 200 - /startupz drives ${startupInitJson.pending?.length ?? 0} pending steps in init-state (${startupInit.status}) and ${startupCompleteJson.pending?.length ?? 0} in complete-state (${startupComplete.status})`,
+      evidence: evidenceFromResponse({
+        route: '/startupz?state=init',
+        response: startupInit,
+        bodyText: startupInitBody,
+        extraFields: {
+          input: { stateSequence: ['init', 'complete'] },
+          derived: {
+            initStatus: startupInit.status,
+            initPending: startupInitJson.pending,
+            completeStatus: startupComplete.status,
+            completePending: startupCompleteJson.pending,
+          },
+          altBodyExcerpt: startupCompleteBody.slice(0, 240),
+        },
+      }),
+    });
+
+    return { results };
+  } finally {
+    await fixture.close();
+  }
+}

package/blueprints/application-api-rest/contributions/probes/probe-utils.mjs

@@ -0,0 +1,177 @@
+// Shared helpers for application-api-rest probes.
+//
+// The engine under probe is the sample-app fixture at
+// packages/rcf-lite/test/fixtures/probe-pack-application-api-rest/server.js. The
+// fixture stamps an x-fixture-request-id header on every response as
+// part of its own request pipeline (no probe-side monkey-patch), so
+// the identifier the probe records is the identifier the engine
+// itself issued. Probes call the fixture over real HTTP via node's
+// fetch, vary inputs, assert derived outputs, and record the
+// request-id, status, body excerpt, the varied input and the derived
+// output as evidence on every result row.
+// No account-bound branch: the engine is a local fixture, not a
+// third-party account, so no CI_HAS_* gate is invented. Every env
+// var this pack reads is declared on the fixture README.
+
+import { mkdir, writeFile } from 'node:fs/promises';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+export const PROJECT_ROOT = resolve(HERE, '..', '..', '..', '..');
+export const FIXTURE_DIR = resolve(PROJECT_ROOT, 'packages/rcf-lite/test/fixtures/probe-pack-application-api-rest');
+export const REPORT_DIR = resolve(PROJECT_ROOT, '.rcf/reports/blueprints/application-api-rest');
+
+export const DEFAULT_PORT = 0;
+
+export function aggregate(results) {
+  if (!Array.isArray(results) || results.length === 0) return 'fail';
+  if (results.some((r) => r.verdict === 'fail')) return 'fail';
+  if (results.some((r) => r.verdict === 'warn')) return 'warn';
+  return 'pass';
+}
+
+// Empty results never pass: a synthesised row is emitted with an actionable detail and its
+// own evidence object recording the empty condition so the row is
+// not a naked verdict scalar.
+export function normaliseResults(results) {
+  if (!Array.isArray(results) || results.length === 0) {
+    return [{
+      anchorReqId: 'unknown',
+      verdict: 'fail',
+      detail: 'no checks ran',
+      evidence: {
+        reason: 'empty-results',
+        route: 'n/a',
+        status: 0,
+        xFixtureRequestId: null,
+        bodyExcerpt: '',
+      },
+    }];
+  }
+  return results;
+}
+
+export async function writeReport({ probeName, engine, results, extra }) {
+  await mkdir(REPORT_DIR, { recursive: true });
+  const report = {
+    slug: 'application-api-rest',
+    probeName,
+    runAt: new Date().toISOString(),
+    engine,
+    results,
+    aggregateVerdict: aggregate(results),
+    ...(extra ?? {}),
+  };
+  const path = resolve(REPORT_DIR, `${probeName}.json`);
+  await writeFile(path, JSON.stringify(report, null, 2) + '\n', 'utf8');
+  return { report, path };
+}
+
+// Starts the fixture on an ephemeral port (or PROBE_PORT when set)
+// and returns { server, port, baseUrl, close }. The close helper
+// rejects when the underlying close callback carries an error;
+// swallowing a teardown error would hide a boundary failure.
+export async function startFixture({ startServer, port } = {}) {
+  const resolvedPort = typeof port === 'number'
+    ? port
+    : Number(process.env.PROBE_PORT ?? DEFAULT_PORT);
+  const started = await startServer({ port: resolvedPort });
+  return {
+    server: started.server,
+    port: started.port,
+    baseUrl: `http://127.0.0.1:${started.port}`,
+    close: () => new Promise((res, rej) => started.server.close((err) => {
+      if (err) rej(err);
+      else res();
+    })),
+  };
+}
+
+// Reads a distinctive slice of a response body: the first N chars
+// so the report carries a body excerpt alongside the header id.
+export function bodyExcerpt(text, max = 240) {
+  if (text == null) return '';
+  const s = typeof text === 'string' ? text : String(text);
+  return s.length > max ? s.slice(0, max) + '...' : s;
+}
+
+// Records the positive-evidence shape on a probe result. Every row
+// carries route, status, the request id the fixture stamped, and a
+// body excerpt; the caller may extend the object with the varied
+// input and the derived output for that row.
+export function evidenceFromResponse({ route, response, bodyText, extraFields }) {
+  return {
+    route,
+    status: response.status,
+    xFixtureRequestId: response.headers.get('x-fixture-request-id') || null,
+    bodyExcerpt: bodyExcerpt(bodyText),
+    ...(extraFields ?? {}),
+  };
+}
+
+export async function runShim(probeName, engine, mainFn) {
+  try {
+    const outcome = (await mainFn()) ?? { results: [] };
+    const { results, extra } = outcome;
+    const { report, path } = await writeReport({ probeName, engine, results: normaliseResults(results), extra });
+    process.stdout.write(JSON.stringify(report, null, 2) + '\n');
+    process.stdout.write(`report written to ${path}\n`);
+    if (report.aggregateVerdict !== 'pass') process.exitCode = 1;
+  } catch (err) {
+    const results = [{
+      anchorReqId: 'unknown',
+      verdict: 'fail',
+      detail: `probe threw: ${err && err.message ? err.message : String(err)}`,
+      evidence: {
+        reason: 'probe-threw',
+        route: 'n/a',
+        status: 0,
+        xFixtureRequestId: null,
+        bodyExcerpt: err && err.stack ? String(err.stack).slice(0, 240) : '',
+      },
+    }];
+    const { report, path } = await writeReport({ probeName, engine, results });
+    process.stdout.write(JSON.stringify(report, null, 2) + '\n');
+    process.stderr.write(`probe error: ${err && err.stack ? err.stack : String(err)}\n`);
+    process.stderr.write(`report written to ${path}\n`);
+    process.exitCode = 1;
+  }
+}
+
+// Browser-observable properties are AMBER on the shelf by ruling.
+// A row that names such a property is recorded as notObservableHere
+// carrying an object with the AC id and a reason; the tally script
+// reads notObservableHere.ac to accept the row.
+export function notObservableHereResult({ ac, anchorAcId, detail, reason, evidence } = {}) {
+  // A notObservableHere row anchors nothing else: no anchorAcId,
+  // no anchorReqId - only notObservableHere.ac.
+  const acId = ac || anchorAcId;
+  return {
+    verdict: 'pass',
+    notObservableHere: {
+      ac: acId,
+      reason: reason || 'not observable on server-side probe pack; needs a browser-driven runner',
+    },
+    detail: detail || 'not observable on server-side probe pack',
+    evidence: {
+      reason: reason || 'not observable here; needs a browser-driven probe runner',
+      ...(evidence || {}),
+    },
+  };
+}
+
+// A row that keeps a real observation but records that the
+// observation only covers part of an AC uses conformanceOnly +
+// limitation carrying the AC id and the property not observed.
+export function conformanceOnlyResult({ anchorAcId, anchorReqId, verdict, detail, evidence, limitation }) {
+  return {
+    ...(anchorAcId ? { anchorAcId } : {}),
+    ...(anchorReqId ? { anchorReqId } : {}),
+    verdict: verdict || 'pass',
+    conformanceOnly: true,
+    limitation: limitation || 'browser-observable property not asserted from the server-side probe',
+    detail,
+    evidence,
+  };
+}

package/blueprints/application-api-rest/contributions/probes/problem-details-on-error.mjs

@@ -0,0 +1,77 @@
+// problem-details-on-error probe for application-api-rest v2.1.10.
+//
+// Verifies AC-2111-1 (RFC 7807 shape and content-type on any error
+// path) and AC-2111-3 (envelope status equals HTTP status line).
+// Each observation is a separate row so a defect at one AC does
+// not hide behind the other's pass.
+//
+// anchorAcId: application-api-rest-AC-2111-1 (row 1) and
+// application-api-rest-AC-2111-3 (row 2).
+
+import { startFixture, evidenceFromResponse } from './probe-utils.mjs';
+
+export const anchorReqId = 'application-api-rest-REQ-009';
+export const accountBound = false;
+
+export default async function runProbe() {
+  const { startServer } = await import('../../../../packages/rcf-lite/test/fixtures/probe-pack-application-api-rest/server.js');
+  const fixture = await startFixture({ startServer, port: 0 });
+  try {
+    const results = [];
+
+    const res = await fetch(`${fixture.baseUrl}/v1/widgets/does-not-exist`);
+    const body = await res.text();
+    const parsed = JSON.parse(body);
+    const cType = res.headers.get('content-type') || '';
+    const requiredFields = ['type', 'title', 'status', 'detail', 'instance'];
+    const missing = requiredFields.filter((k) => !(k in parsed));
+    const shapeOk = res.status === 404
+      && cType.includes('application/problem+json')
+      && missing.length === 0;
+    results.push({
+      anchorAcId: 'application-api-rest-AC-2111-1',
+      anchorReqId: 'application-api-rest-REQ-009',
+      verdict: shapeOk ? 'pass' : 'fail',
+      detail: shapeOk
+        ? 'Every 4xx and 5xx response body is an - GET /v1/widgets/does-not-exist returned application/problem+json with all five RFC 7807 fields'
+        : `Every 4xx and 5xx response body is an - problem-details shape fault: status=${res.status} contentType=${cType} missing=${JSON.stringify(missing)}`,
+      evidence: evidenceFromResponse({
+        route: '/v1/widgets/does-not-exist',
+        response: res,
+        bodyText: body,
+        extraFields: {
+          input: { path: '/v1/widgets/does-not-exist' },
+          derived: { contentType: cType, missingFields: missing },
+        },
+      }),
+    });
+
+    // Row 2: envelope status equals HTTP status line (AC-2111-3).
+    // Drive an unknown route to force a distinct 404 body and check
+    // both status positions agree.
+    const res2 = await fetch(`${fixture.baseUrl}/unknown-route`);
+    const body2 = await res2.text();
+    const parsed2 = JSON.parse(body2);
+    const equalOk = res2.status === 404 && parsed2.status === res2.status;
+    results.push({
+      anchorAcId: 'application-api-rest-AC-2111-3',
+      anchorReqId: 'application-api-rest-REQ-009',
+      verdict: equalOk ? 'pass' : 'fail',
+      detail: equalOk
+        ? `The status field inside the envelope always equals - envelope status=${parsed2.status} equals HTTP status ${res2.status}`
+        : `The status field inside the envelope always equals - status-equality fault: httpStatus=${res2.status} envelopeStatus=${parsed2.status}`,
+      evidence: evidenceFromResponse({
+        route: '/unknown-route',
+        response: res2,
+        bodyText: body2,
+        extraFields: {
+          input: { path: '/unknown-route' },
+          derived: { httpStatus: res2.status, envelopeStatus: parsed2.status, equal: parsed2.status === res2.status },
+        },
+      }),
+    });
+    return { results };
+  } finally {
+    await fixture.close();
+  }
+}

package/blueprints/application-api-rest/contributions/probes/request-id-echoed.mjs

@@ -0,0 +1,76 @@
+// request-id-echoed probe for application-api-rest v2.1.10.
+//
+// Verifies AC-2117-1 (supplied x-request-id echoed verbatim AND the
+// same id appears on the request-scoped log line) and AC-2117-2 (an
+// absent one is generated at the edge).
+//
+// anchorAcId: per-row.
+
+import { startFixture, evidenceFromResponse } from './probe-utils.mjs';
+
+export const anchorReqId = 'application-api-rest-REQ-013';
+export const accountBound = false;
+
+export default async function runProbe() {
+  const { startServer } = await import('../../../../packages/rcf-lite/test/fixtures/probe-pack-application-api-rest/server.js');
+  const fixture = await startFixture({ startServer, port: 0 });
+  try {
+    const results = [];
+
+    const supplied = 'req-supplied-12345';
+    const suppliedRes = await fetch(`${fixture.baseUrl}/livez?deps=up`, { headers: { 'x-request-id': supplied } });
+    const suppliedBody = await suppliedRes.text();
+    const suppliedEcho = suppliedRes.headers.get('x-request-id');
+    // Now inspect the request-scoped log line the fixture emitted.
+    const logRes = await fetch(`${fixture.baseUrl}/__logs?requestId=${encodeURIComponent(supplied)}`);
+    const logBody = await logRes.text();
+    let logJson = null;
+    try { logJson = JSON.parse(logBody); } catch {}
+    const logLineMatches = logRes.status === 200 && logJson && logJson.requestId === supplied && typeof logJson.route === 'string';
+    const suppliedOk = suppliedRes.status === 200 && suppliedEcho === supplied && logLineMatches;
+    results.push({
+      anchorAcId: 'application-api-rest-AC-2117-1',
+      anchorReqId: 'application-api-rest-REQ-013',
+      verdict: suppliedOk ? 'pass' : 'fail',
+      detail: `A request arriving with a valid value in - supplied x-request-id="${supplied}" echoed verbatim on the response and appears on the /__logs line: ${logLineMatches}`,
+      evidence: evidenceFromResponse({
+        route: '/livez?deps=up',
+        response: suppliedRes,
+        bodyText: suppliedBody,
+        extraFields: {
+          input: { xRequestIdSent: supplied },
+          derived: {
+            xRequestIdEchoed: suppliedEcho,
+            matches: suppliedEcho === supplied,
+            logLine: logJson,
+            logStatus: logRes.status,
+          },
+          altBodyExcerpt: logBody.slice(0, 240),
+        },
+      }),
+    });
+
+    const genRes = await fetch(`${fixture.baseUrl}/livez?deps=up`);
+    const genBody = await genRes.text();
+    const generated = genRes.headers.get('x-request-id');
+    const genOk = genRes.status === 200 && typeof generated === 'string' && generated.length >= 16 && generated !== supplied;
+    results.push({
+      anchorAcId: 'application-api-rest-AC-2117-2',
+      anchorReqId: 'application-api-rest-REQ-013',
+      verdict: genOk ? 'pass' : 'fail',
+      detail: `A request arriving without the request-id header owned - absent x-request-id: server generated ${generated}`,
+      evidence: evidenceFromResponse({
+        route: '/livez?deps=up',
+        response: genRes,
+        bodyText: genBody,
+        extraFields: {
+          input: { xRequestIdSent: null },
+          derived: { xRequestIdGenerated: generated, length: generated ? generated.length : 0 },
+        },
+      }),
+    });
+    return { results };
+  } finally {
+    await fixture.close();
+  }
+}

package/blueprints/application-api-rest/contributions/probes/run-cursor-pagination-round-trip.mjs

@@ -0,0 +1,5 @@
+import runProbe from './cursor-pagination-round-trip.mjs';
+import { runShim } from './probe-utils.mjs';
+
+const engine = { kind: 'application-api-rest-fixture', server: 'packages/rcf-lite/test/fixtures/probe-pack-application-api-rest/server.js' };
+runShim('cursor-pagination-round-trip', engine, runProbe);

package/blueprints/application-api-rest/contributions/probes/run-health-probes-distinct.mjs

@@ -0,0 +1,5 @@
+import runProbe from './health-probes-distinct.mjs';
+import { runShim } from './probe-utils.mjs';
+
+const engine = { kind: 'application-api-rest-fixture', server: 'packages/rcf-lite/test/fixtures/probe-pack-application-api-rest/server.js' };
+runShim('health-probes-distinct', engine, runProbe);

package/blueprints/application-api-rest/contributions/probes/run-problem-details-on-error.mjs

@@ -0,0 +1,5 @@
+import runProbe from './problem-details-on-error.mjs';
+import { runShim } from './probe-utils.mjs';
+
+const engine = { kind: 'application-api-rest-fixture', server: 'packages/rcf-lite/test/fixtures/probe-pack-application-api-rest/server.js' };
+runShim('problem-details-on-error', engine, runProbe);

package/blueprints/application-api-rest/contributions/probes/run-request-id-echoed.mjs

@@ -0,0 +1,5 @@
+import runProbe from './request-id-echoed.mjs';
+import { runShim } from './probe-utils.mjs';
+
+const engine = { kind: 'application-api-rest-fixture', server: 'packages/rcf-lite/test/fixtures/probe-pack-application-api-rest/server.js' };
+runShim('request-id-echoed', engine, runProbe);

package/blueprints/application-api-rest/docs/topics.md

@@ -15,7 +15,7 @@ Rules for new topics (inherited from the application-spa vocabulary, restated as
 
 ## Id number bands
 
-Band allocation is ratified policy (2026-08-19); the band IS the AC-collision enforcement mechanism, since AC ids are not namespaced by the 0.4.4 grammar. Composing blueprints take a fresh band rather than proposing namespaced AC ids.
+Band allocation is policy; the band IS the AC-collision enforcement mechanism, since AC ids are not namespaced by the 0.4.4 grammar. Composing blueprints take a fresh band rather than proposing namespaced AC ids.
 
 This table is maintained shelf-wide across every blueprint's `docs/topics.md`. Rows are recorded at ship, never predicted.