Architecture
56 ITDs, 70 anchors, and every one of the 12 standard API decision axes pinned.
Fresh-eyes integrator verdict
Adopt the contract; do not release a Content-dependent flow during this outage.
The serializer, status, problem URI, retryability, issue reference, validation order, and publication identity reproduce from the hosted docs alone. Successful adaptive creation remains deliberately unavailable until Platform3 issue #1138 is resolved. The 20:44 replay verified every pre-Content branch, then received the documented retryable 503 upstream-unavailable from Platform3 Content. API exit 2 is an explicit operationally inconclusive result; hosting still exits 0.
Data dictionary
411 stable anchors, 56 ITD links, 32 endpoint-mapped errors, and explicit adaptive availability.
Customer website
Six endpoint contracts and an honest instruction to branch on the non-retryable release gate.
Adaptive implementation
The contract is verified; current Content read availability is inconclusive until the upstream recovers.
Benchmark: the fetched Qualys SSL Labs analyze API returned READY / A+ at 20:44 UTC. Like SSL Labs, this report exposes an explicit overall state, per-check evidence, and a repeatable reassessment. Unlike the prior attempt, it distinguishes a target contract failure from a dependency availability state.
Fanned-value durability
Both fan identities pass together.
This report declares adaptive_diagnostic in its title, matrix, and audit scope. At 20:47 UTC, the credential-free verifier fetched both canonical reports, both canonical evidence bundles, and both distinct public fan aliases. Each returned 200 and identified its own test kind. The earlier promotion failure is retained in the runtime receipt as resolved incident history, not credited as current proof.
| Canonical cell | Expected matrix kind | Observed matrix kind | Verdict |
|---|---|---|---|
surface_qc@mastery_gate | mastery_gate | mastery_gate | PASS |
surface_qc@adaptive_diagnostic | adaptive_diagnostic | adaptive_diagnostic | PASS |
Publication command:
node site/verify-hosting.mjs exited 0 at 20:47:57 UTC. It verifies both canonical paths, both evidence bundles, distinct deployment aliases, and the expected test_kind at every location.Current canonical HTTP replay
Six contract rows pass; Content rows are availability-dependent.
| Probe | Expected | Observed | Verdict |
|---|---|---|---|
| Public health | 200, testKind=adaptive_diagnostic | 200, exact kind | Pass |
| Anonymous list | Typed RFC 9457 401 | 401 authentication-required | Pass |
| Malformed JSON | Typed 400, no Location | 400 malformed-json | Pass |
| Structurally valid create | Non-retryable typed 422, issue #1138, no Location | Exact problem URI, retryable=false, exact issue, no Location | Pass |
| Same key, changed valid body after gate | 422 again; never 409 | 422; no receipt survived | Pass |
| Invalid DOK distribution | 400 before release gate with RFC 6901 pointer | 400; /rigorPolicy/dokDistribution | Pass |
| Authenticated list | 200, ETag, request-correlated Content trace when Content is available | 503 upstream-unavailable, retryable=true, request-correlated Content 5xx trace | INCONCLUSIVE |
| Unknown query / absent detail | Typed 422 / tenant-opaque 404 | 422 / not reached after typed Content 503; last clean replay 404 at 19:47 | PARTIAL |
Failure atomicity is proven at the boundary. Reusing the release-gated request’s idempotency key with a changed, still-valid body returned the same 422 rather than a changed-body 409. The gate ran before receipt persistence.
Availability receipt: the current rerunner validated the 503 status, RFC problem type,
retryable=true, Content host, 5xx response class, and request correlation before exiting 2. It did not silently accept an arbitrary 503.DoD D5
Real upstreams, honest missing capability.
- Content reads
- The 19:47 clean replay exposed a request-correlated Content 2xx trace. The 20:44 current replay exposed the same real host with a request-correlated 5xx trace and typed retryable 503. The clean replay is retained as historical baseline, not credited as current availability.
- CASE create gate
- The approved current probe found no owner-typed adaptive-eligible Knowledge Components. ITD-043 therefore returns the release-gated 422 before a CASE request or Content write.
- Upstream issue
- Platform3 #1138 is returned in the problem body and is the concrete reopen trigger.
- Local substitute
- None credited. The QC rejects copied standards, placeholder GUIDs, or a fabricated 202 as integration proof.
Two distinct upstream states. Adaptive create success is release-gated by the CASE corpus gap in #1138. Separately, Content reads are temporarily unavailable. Neither state is replaced by local data.
DoD D2
Tenant boundaries fail closed.
Anonymous API denial
A tenant-data list request without Authorization returned a typed 401.
Cross-tenant opacity
The 19:47 replay proved non-enumerating isolation. The current replay cannot re-exercise this row while Content is unavailable; the boundary fails with 503 and exposes no tenant data.
Direct datastore denial
Unauthenticated Supabase REST access to Blueprint working state returned 401.
Published evidence
No JWT, service key, raw idempotency key, opaque resource id, or tenant response payload is retained.
Security model: API-fronted datastore. Tenant routing comes from the verified JWT; service credentials remain server-side.
Docs ↔ implementation
One contract, four deliverables.
The live architecture, data dictionary, and customer website each returned 200 at 20:44 and were byte-identical to their approved artifact. The current implementation agrees with their error contract: auth and validation run locally, valid create is release-gated before side effects, and an unavailable Content dependency returns a typed retryable 503.
| Published artifact | SHA-256 | Approved bytes |
|---|---|---|
| Architecture | 0417714e…21d7de | Equal |
| Data dictionary | 3cd29442…145795 | Equal |
| Customer website | 0362d6a9…9a988 | Equal |
Findings and routing
No contract rollback; one operator-visible availability blocker.
The Content outage is not a Blueprint BUG or FEATURE request: the implementation matches its published typed-503 contract and proves the declared upstream is real. It does block a current Content-dependent release, so it is ranked above the resolved hosting history. No architecture, dictionary, website, implementation, or sibling QC cell needs rollback.
- Blocking findings
- Operational: Platform3 Content currently returns 5xx. Contract adoption may proceed; a Content-dependent production release should wait for rerunner exit 0.
- Rollback target
- None.
- Hosting acceptance
- Distinct deployment URLs; both canonical fan paths identify themselves; verifier exit 0.
- Declared gap
- Platform3 CASE owner-typed adaptive KC corpus, tracked by #1138.
- Customer action
- Adopt the stable 422 and typed-503 branches now; require API rerunner exit 0 before releasing the Content-dependent flow.
Independent reassessment
One command reruns the evidence.
BLUEPRINT_REVIEWER_JWT="$BLUEPRINT_REVIEWER_JWT" \
BLUEPRINT_PROD_REVIEWER_JWT="$BLUEPRINT_PROD_REVIEWER_JWT" \
BLUEPRINT_ISOLATION_REVIEWER_JWT="$BLUEPRINT_ISOLATION_REVIEWER_JWT" \
SUPABASE_URL="$SUPABASE_URL" \
node site/probe.mjs
node site/verify-hosting.mjsAPI exit 0 means every row, including cross-tenant and direct-datastore probes, reproduced. Exit 1 is reserved for a contract divergence, including an untyped or malformed 503. Exit 2 means the replay is inconclusive: a required fixture is unavailable, or Platform3 Content returned the exact documented retryable upstream-unavailable envelope with a correlated 5xx trace. Hosting exit 0 requires both fan values simultaneously. The current recorded results are API exit 2 (typed_upstream_unavailable) and hosting exit 0; the last clean full API replay exited 0 at 19:47.