Architecture
All 12 standard API decision axes are explicitly pinned.
Fresh-eyes integrator verdict
The API contract is adoptable. The current deployment is not release-ready.
Who: the engineer maintaining AcmeTest. Job: wire a weekly unit-test client from published docs alone. The docs, local contract suite, authentication boundary, and live dependency-failure behavior agree. The one path that matters most today—bounded formative create through native Content readback—cannot complete while Platform3 Content is unavailable.
Data dictionary
Published bytes match the approved artifact and name the formative shapes.
Customer website
The exact fixture, typed 503 branch, and recovery action are documented.
Implementation
CASE is real and healthy; Content 5xx prevents end-to-end success.
Benchmark: Qualys SSL Labs API. Its current reassessment completed READY while exposing two failed endpoints instead of hiding them. This report follows that bar with an explicit overall state, expected-versus-observed checks, dependency attribution, and a rerunnable probe; it adds authenticated contract, tenant, datastore, and docs-byte checks.
Current canonical HTTP replay
Boundary checks pass; the Content-dependent journey is inconclusive.
| Probe | Expected | Observed | Verdict |
|---|---|---|---|
| Public health | 200, testKind=formative | 200, exact kind | Pass |
| Anonymous list | Typed RFC 9457 401 | 401 authentication-required, correlated request id | Pass |
| Wrong kind | Typed 400 with /testKind | 400 before any upstream write | Pass |
| Published two-standard create | 202 ready; relative Location | 503 upstream-unavailable, retryable=true | Inconclusive |
| Upstream path | Two CASE 2xx; Content create/read 2xx | Two CASE 2xx, then Content 5xx, same request correlation | Real wire |
| Poll, readback, list, idempotency, ETag | Exact documented success shapes | Not reached after validated dependency failure | Inconclusive |
| Local contract suite | All promised branches covered | 19/19 tests pass | Pass |
Current outage receipt. The replay accepted this as an operationally inconclusive state only after validating status 503,
application/problem+json, the stable problem URI, retryable=true, two CASE 2xx traces, one Content 5xx trace, and request correlation. An arbitrary or malformed 503 is a contract failure.Historical baseline, clearly labeled. On 27 July at 21:33 UTC, the same published flow returned 202, two CASE 2xx and two Content 2xx traces, then Content readback showed
per_standard, two KC keys, ten items, and maxItemOverlap=1. That proves prior operation, not current availability.DoD D5
The failure proves the integration is real.
- CASE
- The demo-tenant request dereferenced both published standard GUIDs on the Platform3 host and recorded two 2xx response classes.
- Content
- The same request reached Platform3 Content and recorded a 5xx response class before AlphaTest returned its typed 503.
- Local substitute
- None. No fixture, copied standard, mock test_spec, or fabricated 202 was accepted.
- Customer effect
- No operation exists, so there is nothing to poll or assign. Retry the exact body with the exact idempotency key only after the dependency recovers.
DoD D2
Current public paths fail closed; live tenant isolation still needs a clean Content window.
Anonymous API
Tenant-data list without Authorization returned the typed denial.
Direct datastore
Unauthenticated Supabase REST access to working state was denied.
Cross-tenant read
Content must list a tenant-A fixture before tenant B can replay the required opaque 404.
Evidence bundle
No JWT, service key, raw idempotency key, tenant payload, operation id, or Content id is retained.
Security model: API-fronted datastore. The implementation verifies HS256 JWTs, derives tenant routing from the signed claim, keeps service credentials server-side, enables RLS, and revokes browser-role access. Current wire evidence proves public denial, not a fresh cross-tenant success claim.
Docs ↔ implementation
Approved docs are live byte-for-byte, and the outage follows their contract.
| Artifact | Live status | SHA-256 | Approved bytes |
|---|---|---|---|
| Architecture | 200 | 0417714e…21d7de | Equal |
| Data dictionary | 200 | 3cd29442…145795 | Equal |
| Customer website | 200 | 0362d6a9…9a988 | Equal |
The site promises 202 when dependencies are available and separately promises typed, retryable 503 for an unavailable required owner. The current wire follows the latter. This is not grounds to rewrite the contract as 503-only.
Finding triage and rollback
No Blueprint rollback. One operator-visible release blocker.
BUG vs FEATURE: neither. The live implementation matches the published dependency-failure commitment and proves the declared upstream call. The blocker is current Platform3 Content availability, outside this module’s owned artifacts. Fabricating a local Content record would violate DoD D5.
- Severity 1
- Release blocker: formative create cannot currently reach 202 because Platform3 Content returns 5xx.
- Severity 2
- Verification gap: cross-tenant opacity cannot be freshly exercised until Content can list a tenant-A fixture.
- Rollback target
- None. Architecture, dictionary, website, and implementation agree on this failure mode.
- Exit criterion
- Rerun
probe.mjs; require exit 0 with create, poll, readback, idempotency, ETag, list, and cross-tenant checks passing.
Independent reassessment
One credential-safe command reruns the boundary.
BLUEPRINT_PROD_REVIEWER_JWT="$BLUEPRINT_PROD_REVIEWER_JWT" \
BLUEPRINT_ISOLATION_REVIEWER_JWT="$BLUEPRINT_ISOLATION_REVIEWER_JWT" \
SUPABASE_URL="$SUPABASE_URL" \
node site/probe.mjsExit 0 means all current checks pass. Exit 1 means a contract divergence. Exit 2 means a required fixture is unavailable or the exact documented, request-correlated Content outage was reproduced. The current result is exit 2.