rcf-lite 0.21.0 → 0.23.0

package/rcf/user-stories/us-2902.json

@@ -0,0 +1,36 @@
+{
+  "createdAt": "2026-09-07T09:11:05.250Z",
+  "updatedAt": "2026-09-07T09:11:05.250Z",
+  "asA": "shelf consumer applying the deploy-cloudflare-workers v1.2.0 blueprint who wants the two new elicits to appear in the operator elicit prompt with sane defaults",
+  "iWant": "the blueprint.json top-level elicits[] to declare both new entries (assets-directory kind string default empty; run-worker-first kind boolean default false), the CLI to accept --answer assets-directory=<path> and --answer run-worker-first=<bool> at blueprint add, and the generated wrangler.toml under the applied project to reflect the answered values",
+  "soThat": "a project answering assets-directory=./dist gets [assets] directory = \"./dist\" emitted in its wrangler.toml, a project not answering assets-directory keeps the bare-Worker shape without any [assets] block, and the two elicits do not affect any shipped v1.1.0 contribution",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-2902-1",
+      "description": "The blueprint.json elicits[] block gains exactly two new entries: assets-directory with id assets-directory, kind string, default empty string, prompt describing the applied static-assets root; run-worker-first with id run-worker-first, kind boolean, default false, prompt describing the SPA fallback discipline that a truthy answer runs the Worker before asset lookup. The two elicits pass the loader's validateElicits shape gate on src/blueprint/loader.js (id kebab-slug, kind one of enum|string|boolean, default matches kind). Neither elicit carries providesCapability (both are shape choices not custom-auth discovery). The spec's intended when-predicate {elicitedNonEmpty: [assets-directory]} on run-worker-first is NOT shipped this round because the loader's supported when block only accepts requiresCapability arrays; the guide names the shape trade and CONCERNS on the PR names the smallest loader extension to close the gap.",
+      "given": "the shipped blueprint.json at blueprints/deploy-cloudflare-workers/blueprint.json",
+      "when": "jq .elicits returns the top-level array and the loader loads blueprint.json without a validation error",
+      "then": "the array contains exactly two entries whose ids are assets-directory and run-worker-first, with the shapes above; jq validation and the loader both accept the shape",
+      "testable": true,
+      "scope": "library"
+    },
+    {
+      "id": "AC-2902-2",
+      "description": "The cf-platform fixture at packages/rcf-lite/test/fixtures/cf-platform/ ships a wrangler.toml with [assets] directory = \"./dist\" and run_worker_first = true baked into the [assets] block. The fixture ships dist/index.html so the assets directory exists on disk. The fixture ships src/index.mjs as the minimal Worker entry, a package.json declaring wrangler as a devDependency and start = wrangler dev, a run-assets-manifest-scan.mjs shim requiring the probe module from blueprints/deploy-cloudflare-workers/contributions/probes/assets-manifest-scan.mjs, and a README naming the wrangler dev boot line, the two elicit answers baked into wrangler.toml, and the two induced-failure switches SIMULATE_MIXED_SHAPE (inserts a pages_build_output_dir field so the probe surfaces the mixed-shape refusal) and SIMULATE_EMPTY_ASSETS (removes the [assets] block so the probe records the bare-Worker shape and passes with an empty-directory record).",
+      "given": "the cf-platform fixture tree after this T-0 slice lands",
+      "when": "ls -R the fixture directory",
+      "then": "the fixture ships wrangler.toml with the [assets] block, dist/index.html, src/index.mjs, package.json with wrangler dev, run-assets-manifest-scan.mjs and README.md with the switches and boot line documented",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tags": [
+    "blueprint:deploy-cloudflare-workers"
+  ],
+  "usId": "US-2902",
+  "prdId": "PRD-001",
+  "reqId": "REQ-029",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-0 assets-directory and run-worker-first elicits on blueprint.json top-level elicits[] and baked into the cf-platform fixture wrangler.toml"
+}

package/rcf/user-stories/us-3001.json

@@ -0,0 +1,45 @@
+{
+  "createdAt": "2026-09-07T09:11:05.463Z",
+  "updatedAt": "2026-09-07T09:11:05.463Z",
+  "asA": "shelf consumer applying the deploy-cloudflare-workers v1.2.0 blueprint on a project migrating from Cloudflare Pages",
+  "iWant": "an ADR blessing the Workers-with-static-assets shape as the ratified SPA-on-Workers deploy shape over Pages (ADR-1306-deploy-cloudflare-workers-spa-shape) carrying the verbatim Cloudflare Pages landing-page recommendation, a guide section titled Workers-with-static-assets: the SPA-on-Workers shape that links the Cloudflare migrate-from-Pages guide, and the SPA fallback discipline elicited via run_worker_first so a truthy answer emits run_worker_first = true under the [assets] block on the generated wrangler.toml",
+  "soThat": "a project can read the ratified shape decision with its standards trace to Cloudflare's own landing-page recommendation and know exactly how to migrate its Pages routing to Workers",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-3001-1",
+      "description": "The ADR contribution entry ADR-1306-deploy-cloudflare-workers-spa-shape sits under contributions/adrs/adr-1306-deploy-cloudflare-workers-spa-shape.json and validates against the rcf-schemas 0.6.1 ADR shape (required fields adrId prdId tadId version status title context decision consequences createdAt updatedAt; optional alternativesConsidered supersededBy relatedAdrs). Its body carries the verbatim Cloudflare Pages landing-page quote Workers supports most Pages use cases and offers a broader feature set. It is Cloudflare's primary platform for building applications. Start new projects with Workers., alongside a decision blessing Workers-with-static-assets as the SPA-on-Workers deploy shape and consequences naming the two new elicits assets-directory and run-worker-first. The ADR contribution entry in blueprint.json carries recommendedDefault true, elicited false and standardsTraceClause Cloudflare Pages landing-page recommendation (2026-09-06). The ADR body does NOT carry standardsTraceClause (per section 8a.2 the clause belongs on the contribution entry).",
+      "given": "the shipped ADR contribution",
+      "when": "jq queries against blueprint.json contribution entry and the ADR JSON body",
+      "then": "the blueprint.json entry carries standardsTraceClause set to the 2026-09-06 landing-page recommendation clause; the ADR body carries the verbatim Cloudflare Pages landing-page quote in context or decision; the ADR body does not carry standardsTraceClause; the ADR body validates against the 0.6.1 ADR schema",
+      "testable": true,
+      "scope": "library"
+    },
+    {
+      "id": "AC-3001-2",
+      "description": "The guide at blueprints/deploy-cloudflare-workers/guide/deploy-cloudflare-workers.md gains a new section titled Workers-with-static-assets: the SPA-on-Workers shape with the verbatim Cloudflare landing-page quote, the two elicit signatures (assets-directory string default empty; run-worker-first boolean default false), a copy-paste wrangler.toml snippet showing the [assets] block with directory and the run_worker_first hint, and a link to the Cloudflare migrate-from-Pages guide at https://developers.cloudflare.com/workers/static-assets/migration-guides/migrate-from-pages/. The Cloudflare Workers static-assets doc at https://developers.cloudflare.com/workers/static-assets/ is cited in the same section. Both URLs return 200 at gate time.",
+      "given": "the updated guide file",
+      "when": "grep the guide for the new section heading and the two Cloudflare URLs",
+      "then": "the section heading appears once with the exact title; the migrate-from-Pages URL and the static-assets doc URL appear at least once each; both URLs return HTTP 200 on a plain curl -fsSI",
+      "testable": true,
+      "scope": "library"
+    },
+    {
+      "id": "AC-3001-3",
+      "description": "The spec's second canonical AC spaFallbackShape is realised in the blueprint contributions as AC-12113-2 on US-12113 with a runtime-observable then clause anchored to TAC-1302-deploy-cloudflare-workers-wrangler-manifest. The shipped probe assets-manifest-scan.mjs asserts run_worker_first presence and value under the [assets] block against the elicited answer. On the cf-platform fixture (which bakes run_worker_first = true) the probe returns verdict pass and the report carries a detail record naming runWorkerFirst true. On the SIMULATE_MIXED_SHAPE=true branch the fixture inserts a pages_build_output_dir field and the probe returns verdict fail naming the offending pages_build_output_dir line. On the SIMULATE_EMPTY_ASSETS=true branch the fixture removes the [assets] block and the probe returns verdict pass with an empty-directory record (bare-Worker shape).",
+      "given": "the shipped probe module and the cf-platform fixture with induced-failure switches",
+      "when": "run-assets-manifest-scan.mjs drives the probe on each of the three fixture states",
+      "then": "aggregateVerdict pass on the canonical state; aggregateVerdict fail on SIMULATE_MIXED_SHAPE with detail naming pages_build_output_dir; aggregateVerdict pass on SIMULATE_EMPTY_ASSETS with the empty-directory record",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tags": [
+    "blueprint:deploy-cloudflare-workers"
+  ],
+  "usId": "US-3001",
+  "prdId": "PRD-001",
+  "reqId": "REQ-030",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-0 ADR-1306-deploy-cloudflare-workers-spa-shape, guide section with migrate-from-Pages link, and probed spaFallbackShape with induced-failure switches"
+}

package/rcf/user-stories/us-4001.json

@@ -0,0 +1,69 @@
+{
+  "createdAt": "2026-09-06T16:59:00.000Z",
+  "updatedAt": "2026-09-06T16:59:00.000Z",
+  "usId": "US-4001",
+  "prdId": "PRD-001",
+  "reqId": "REQ-040",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "The persistence-data-postgres blueprint ships on the shelf; six Node-only probes pass against a live postgres:17-alpine container and refuse on each induced failure",
+  "asA": "shelf consumer applying the persistence-data-postgres v1.0.0 blueprint",
+  "iWant": "the shipped blueprint files with 26 contributions and six probes, a sample-app fixture that boots postgres:17-alpine and applies three toy forward-only migrations, and gate-runnable proof that every probe passes on the canonical fixture state and refuses on each induced-failure switch",
+  "soThat": "a rcf-lite project applying this blueprint gets a facade contract over pg with numbered forward-only migrations, prepared-statement discipline, transactional atomicity, a two-path recovery model, and pool posture per deploy target, with runtime-observable ACs proven by probes the HQ gate runs against a real Postgres container rather than a simulated harness",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-4001-1",
+      "description": "The shelf carries blueprints/persistence-data-postgres/blueprint.json declaring slug persistence-data-postgres, version 1.0.0, category persistence, 26 contributions in the 7 REQ / 10 US / 4 TAC / 5 ADR groups per infra round 5 spec section 5.1; capabilities is [relationalStore]; suggestedCompanions declares logging and errorHandling with spec section 5.1 reasons; providesRoles is absent; requiresAppliedCapabilities is absent.",
+      "given": "the shelf tree after this blueprint lands",
+      "when": "jq queries against blueprints/persistence-data-postgres/blueprint.json",
+      "then": "jq .slug returns persistence-data-postgres; jq .version returns 1.0.0; jq .contributions | length returns 26; jq .capabilities | index(relationalStore) returns 0; jq .suggestedCompanions | length returns 2",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-4001-2",
+      "description": "rcf define blueprint add ./blueprints/persistence-data-postgres applies the 26 contributions cleanly on a fresh init project with no other persistence blueprint applied; rcf define validate reports the tree clean; both rcf audit coverage --strict and rcf audit eval coverage --strict exit 0 on the scratch project.",
+      "given": "a fresh rcf init scratch project with no persistence-* blueprint applied",
+      "when": "rcf define blueprint add ./blueprints/persistence-data-postgres runs, then rcf define validate, then rcf audit coverage --strict, then rcf audit eval coverage --strict",
+      "then": "every command exits 0; the scratch project's rcf tree contains the 26 contributions; no globalAdrTopic conflict is raised",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-4001-3",
+      "description": "rcf define blueprint add ./blueprints/persistence-data-postgres on a scratch project with persistence-data-d1 already applied surfaces a DELIBERATE conflict on the persistenceStore and migrationDiscipline global-ADR topics per the round-2 pattern; the tree is untouched by the failed add.",
+      "given": "a fresh rcf init scratch project with persistence-data-d1 v1.0.0 already applied",
+      "when": "rcf define blueprint add ./blueprints/persistence-data-postgres runs against the scratch project",
+      "then": "the add refuses with a globalAdrTopic conflict list containing persistenceStore and migrationDiscipline; the scratch project's rcf tree does not carry persistence-data-postgres contributions after the refusal",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-4001-4",
+      "description": "The six probe modules under blueprints/persistence-data-postgres/contributions/probes/ each pass against a running postgres:17-alpine container brought up from the sample-app fixture: facade-round-trip asserts facadeReady fires and the round-trip returns; migration-apply asserts three migrations apply inside individual transactions and schema_version advances to 3; prepared-statement-scan asserts every pg.query first-argument node is a static string literal; transaction-atomicity asserts a rollback fires with the failing statement index; recovery-restore-round-trip asserts row-count and checksum equality between source and restored databases; pool-posture-smoke asserts twenty concurrent queries return with no timeout. Each per-blueprint probe report at .rcf/reports/blueprints/persistence-data-postgres/<probe-name>.json carries aggregateVerdict pass.",
+      "given": "the sample-app fixture at packages/rcf-lite/test/fixtures/infra-postgres/ with docker compose up -d postgres running and the fixture applied",
+      "when": "each of the six run-<probe-name>.mjs shims runs against the fixture in sequence",
+      "then": "every shim exits 0; every per-blueprint report file carries aggregateVerdict pass; every result carries an anchorAcId matching a contributed AC id on the blueprint",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-4001-5",
+      "description": "The sample-app fixture's induced-failure switches surface each probe's negative-run behaviour: SIMULATE_MIGRATION_FAILURE=true makes run-migration-apply.mjs exit non-zero with the failing migration filename in its report and the transaction rolled back; SIMULATE_CONSTRAINT_VIOLATION=true names the transaction-atomicity probe's rollback observation. Every negative-run report carries aggregateVerdict fail on the AC anchored to the observation the switch corrupts.",
+      "given": "the sample-app fixture with docker compose up -d postgres running",
+      "when": "the migration-apply probe runs with SIMULATE_MIGRATION_FAILURE=true, and the transaction-atomicity probe runs with SIMULATE_CONSTRAINT_VIOLATION=true",
+      "then": "the migration-apply shim exits non-zero and its report at .rcf/reports/blueprints/persistence-data-postgres/migration-apply.json carries aggregateVerdict fail with the failing migration filename in a detail field; the transaction-atomicity probe records the rollback event with statementIndex 1 as evidence of the constraint-violation semantics",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-4001-6",
+      "description": "The blueprint ships a sample-app fixture, a README, a CHANGELOG, a guide, and a docs/topics.md entry; the shelf-wide id-band registry table gains a persistence-data-postgres row at US band 27101-27899 / ADR-TAC suffix block 28xx across every shipped blueprint's docs/topics.md; packages/rcf-lite/docs/blueprint-authoring.md section 6a capability-declaration table gains one row for relationalStore per infra round 5 spec section 5.6.",
+      "given": "the shelf tree after this blueprint lands",
+      "when": "grep queries walk every blueprint's docs/topics.md and the section 6a table",
+      "then": "packages/rcf-lite/docs/blueprint-authoring.md contains a table row beginning | relationalStore |; every shipped blueprint's docs/topics.md carries a row beginning | persistence-data-postgres | with the 27101-27899 band and 28xx suffix; blueprints/persistence-data-postgres/README.md, CHANGELOG.md, guide/persistence-data-postgres.md, docs/topics.md, and packages/rcf-lite/test/fixtures/infra-postgres/ all exist; the fixture README names the docker and podman incantations and the two induced-failure switches",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ]
+}

package/rcf/user-stories/us-4101.json

@@ -0,0 +1,69 @@
+{
+  "createdAt": "2026-09-06T17:50:03.129Z",
+  "updatedAt": "2026-09-06T17:50:03.129Z",
+  "asA": "shelf consumer applying the object-storage-s3 v1.0.0 blueprint",
+  "iWant": "the shipped blueprint files with 21 contributions, six probes, and the T-2 side of the shared sample-app fixture that boots MinIO and applies the security-secrets-management shim, plus gate-runnable proof that every probe passes on the canonical fixture state and refuses on each induced-failure switch",
+  "soThat": "a rcf-lite project applying this blueprint gets an S3-shape facade over @aws-sdk/client-s3 or aws4fetch with put/get/delete/list, presigned URLs with bounded TTL, multipart-upload above threshold, a lifecycle-event sink with metadata-only fields, and a compose-time refusal on missing security-secrets-management, with runtime-observable ACs proven by probes the HQ gate runs against a real MinIO container",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-4101-1",
+      "description": "The shelf carries blueprints/object-storage-s3/blueprint.json declaring slug object-storage-s3, version 1.0.0, category object-storage, 21 contributions in the 6 REQ / 8 US / 3 TAC / 4 ADR groups per infra round 5 spec section 5.2; capabilities is [objectStorage]; suggestedCompanions declares logging and errorHandling with spec section 5.2 reasons; providesRoles is absent; requiresAppliedCapabilities is absent; every ADR contribution entry carries a non-null standardsTraceClause per section 8a.2.",
+      "given": "the shelf tree after this blueprint lands",
+      "when": "jq queries against blueprints/object-storage-s3/blueprint.json",
+      "then": "jq .slug returns object-storage-s3; jq .version returns 1.0.0; jq .contributions | length returns 21; jq .capabilities returns [objectStorage]; jq .suggestedCompanions | length returns 2; jq .contributions[] | select(.kind==adr) | .standardsTraceClause returns a non-null string for every entry",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-4101-2",
+      "description": "rcf define blueprint add ./blueprints/object-storage-s3 applies the 21 contributions cleanly on a fresh init project with security-secrets-management already applied; rcf define validate reports the tree clean; both rcf audit coverage --strict and rcf audit eval coverage --strict exit 0 on the scratch project.",
+      "given": "a fresh rcf init scratch project with security-secrets-management applied",
+      "when": "rcf define blueprint add ./blueprints/object-storage-s3 runs, then rcf define validate, then rcf audit coverage --strict, then rcf audit eval coverage --strict",
+      "then": "every command exits 0; the scratch project's rcf tree contains the 21 contributions; no globalAdrTopic conflict is raised",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-4101-3",
+      "description": "rcf define blueprint add ./blueprints/object-storage-s3 on a scratch project without security-secrets-management refuses with exit 3 and stable message id object-storage-s3-no-secrets on stderr per REQ-006 and spec section 5.2; the --allow-no-secrets-yet override lands the contributions with a note recorded on source.notes for later reconciliation.",
+      "given": "a fresh rcf init scratch project with no security-secrets-management applied",
+      "when": "rcf define blueprint add ./blueprints/object-storage-s3 runs against the scratch project, then the same command runs with --allow-no-secrets-yet",
+      "then": "the first invocation exits 3 with stderr containing object-storage-s3-no-secrets and naming security-secrets-management and the override flag; the scratch tree does not carry object-storage-s3 contributions after the refusal; the second invocation exits 0 and the applied manifest records a source.notes entry naming the missing predecessor",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-4101-4",
+      "description": "The six probe modules under blueprints/object-storage-s3/contributions/probes/ each pass against a running MinIO container brought up from the shared sample-app fixture: facade-round-trip asserts facadeReady fires with endpointHost and bucketName; put-get-round-trip asserts 1 KiB round-trip byte-equal, list under prefix, and delete round-trip with objectDeleted; presigned-url asserts 200 within TTL, 403 on tampered signature, and floor refusal below 60 s; multipart-upload asserts 10 MiB round-trip byte-equal via multipart with no orphan in-flight uploads; event-secrecy asserts the whitelist and no PII fixture leak; r2-real-account-smoke exits 0 with accountBoundSkipped:true without CI_HAS_CLOUDFLARE_ACCOUNT or runs a real R2 round-trip when the env var is set. Each per-blueprint probe report at .rcf/reports/blueprints/object-storage-s3/<probe-name>.json carries aggregateVerdict pass.",
+      "given": "the shared sample-app fixture at packages/rcf-lite/test/fixtures/infra-s3-and-queue/ with docker compose up -d minio running and the rcf-test bucket created",
+      "when": "each of the six run-<probe-name>.mjs shims runs against the fixture in sequence",
+      "then": "every shim exits 0; every per-blueprint report file carries aggregateVerdict pass; every result carries an anchorAcId matching a contributed AC id on the blueprint",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-4101-5",
+      "description": "The sample-app fixture's induced-failure switches surface each probe's negative-run behaviour: SIMULATE_PART_UPLOAD_FAIL=true drives the multipart-upload probe's AC-28104-2 abort-on-failure path; SIMULATE_PRESIGN_MALFORMED=true drives the presigned-url probe's tampered-signature 403 path; SIMULATE_403_ON_GET=true drives the put-get-round-trip probe's fail on AC-28102-1. Each switched-run report carries aggregateVerdict fail on the AC anchored to the observation the switch corrupts (except SIMULATE_PART_UPLOAD_FAIL which surfaces the pass-on-abort-shape).",
+      "given": "the shared fixture with MinIO running",
+      "when": "each named induced-failure switch is set in turn and the paired probe runs",
+      "then": "SIMULATE_PART_UPLOAD_FAIL true yields multipart-upload report with AC-28104-2 pass and no orphan uploads; SIMULATE_403_ON_GET true yields put-get-round-trip report with aggregateVerdict fail; SIMULATE_PRESIGN_MALFORMED true yields presigned-url first-fetch 403 and aggregateVerdict fail; the fixture README documents each switch and the paired probe",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-4101-6",
+      "description": "The blueprint ships a sample-app fixture entry, a README, a CHANGELOG, a guide, and a docs/topics.md entry; the shelf-wide id-band registry table gains an object-storage-s3 row at US band 28101-28899 / ADR-TAC suffix block 29xx across every shipped blueprint's docs/topics.md; packages/rcf-lite/docs/blueprint-authoring.md section 6a capability-declaration table gains one row for objectStorage per infra round 5 spec section 5.6.",
+      "given": "the shelf tree after this blueprint lands",
+      "when": "grep queries walk every blueprint's docs/topics.md and the section 6a table",
+      "then": "packages/rcf-lite/docs/blueprint-authoring.md contains a table row beginning | objectStorage |; every shipped blueprint's docs/topics.md carries a row beginning | object-storage-s3 | with the 28101-28899 band and 29xx suffix; blueprints/object-storage-s3/README.md, CHANGELOG.md, guide/object-storage-s3.md, docs/topics.md, and packages/rcf-lite/test/fixtures/infra-s3-and-queue/ all exist; the fixture README names docker and podman incantations and four wired induced-failure switches",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "usId": "US-4101",
+  "prdId": "PRD-001",
+  "reqId": "REQ-041",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "The object-storage-s3 blueprint ships on the shelf with five MinIO probes plus one accountBound R2 smoke"
+}

package/rcf/user-stories/us-4201.json

@@ -0,0 +1,69 @@
+{
+  "createdAt": "2026-09-06T19:17:37.906Z",
+  "updatedAt": "2026-09-06T19:17:37.906Z",
+  "asA": "shelf consumer applying the messaging-queue-cloudflare v1.0.0 blueprint",
+  "iWant": "the shipped blueprint files with 20 to 24 contributions, six probes, and the T-3 side of the shared sample-app fixture that boots a Cloudflare Worker under wrangler dev with a queue binding and a DLQ binding, plus gate-runnable proof that every probe passes on the canonical fixture state and refuses on each induced-failure switch",
+  "soThat": "a rcf-lite project applying this blueprint gets a producer facade over the Cloudflare Queues binding with publish, consume, ack, retry, and DLQ, a lifecycle-event sink with metadata-only fields, and the queue capability the jobs-background blueprint composes on at apply time, with runtime-observable ACs proven by probes the HQ gate runs against a real wrangler dev process",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-4201-1",
+      "description": "The shelf carries blueprints/messaging-queue-cloudflare/blueprint.json declaring slug messaging-queue-cloudflare, version 1.0.0, category messaging, 21 contributions in the 6 REQ / 8 US / 3 TAC / 4 ADR groups per infra round 5 spec section 5.3; capabilities is [queue]; suggestedCompanions declares logging and errorHandling with spec section 5.3 reasons; providesRoles is absent; requiresAppliedCapabilities is absent; every ADR contribution entry carries a non-null standardsTraceClause per section 8a.2.",
+      "given": "the shelf tree after this blueprint lands",
+      "when": "jq queries against blueprints/messaging-queue-cloudflare/blueprint.json",
+      "then": "jq .slug returns messaging-queue-cloudflare; jq .version returns 1.0.0; jq .contributions | length returns 21; jq .capabilities returns [queue]; jq .suggestedCompanions | length returns 2; jq .contributions[] | select(.kind==adr) | .standardsTraceClause returns a non-null string for every entry",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-4201-2",
+      "description": "rcf define blueprint add ./blueprints/messaging-queue-cloudflare applies the 21 contributions cleanly on a fresh init project; rcf define validate reports the tree clean; both rcf audit coverage --strict and rcf audit eval coverage --strict exit 0 on the scratch project.",
+      "given": "a fresh rcf init scratch project",
+      "when": "rcf define blueprint add ./blueprints/messaging-queue-cloudflare runs, then rcf define validate, then rcf audit coverage --strict, then rcf audit eval coverage --strict",
+      "then": "every command exits 0; the scratch project's rcf tree contains the 21 contributions; no globalAdrTopic conflict is raised",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-4201-3",
+      "description": "REQ-004 description names the dead_letter_queue field literal (per fetched Cloudflare Queues DLQ documentation) and the DLQ retention 4 days; jq grep on the contribution set returns at least one match for dead_letter_queue and at least one match for the retention constant.",
+      "given": "the shelf blueprint contribution set",
+      "when": "jq .contributions[] | select(.id==messaging-queue-cloudflare-REQ-004) | .description on the requirement file",
+      "then": "the description mentions dead_letter_queue and 4 days retention with the source URL literal https://developers.cloudflare.com/queues/configuration/dead-letter-queues/",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-4201-4",
+      "description": "The six probe modules under blueprints/messaging-queue-cloudflare/contributions/probes/ each pass against a running wrangler-dev seam brought up from the shared sample-app fixture: producer-facade-ready asserts producerReady fires with the queue name; publish-to-delivery asserts consumer receives all 5 messages with matching bodies and trace-ids; retry-and-dlq asserts DLQ contents at attempt-counter 3 and messageDeadLettered fires; event-secrecy asserts no PII fixture text in any event record; real-account-concurrency-smoke exits 0 with accountBoundSkipped true without CI_HAS_CLOUDFLARE_ACCOUNT or runs a real 500-message round-trip when the env var is set. Each per-blueprint probe report at .rcf/reports/blueprints/messaging-queue-cloudflare/<probe-name>.json carries aggregateVerdict pass.",
+      "given": "the shared sample-app fixture at packages/rcf-lite/test/fixtures/infra-s3-and-queue/ with the T-3 wrangler-dev seam booted (or the in-memory queue-driver mode active for probes needing no live Wrangler process)",
+      "when": "each of the six run-<probe-name>.mjs shims runs against the fixture in sequence",
+      "then": "every shim exits 0; every per-blueprint report file carries aggregateVerdict pass; every result carries an anchorAcId matching a contributed AC id on the blueprint",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-4201-5",
+      "description": "The sample-app fixture's three induced-failure switches surface each probe's negative-run behaviour: SIMULATE_CONSUMER_RETRY=true drives the retry-and-dlq probe's re-delivery path and (at max-attempts) the DLQ landing; SIMULATE_DLQ_OVERFLOW=true drives the retry-and-dlq probe past max-attempts on the first delivery so the message lands on the DLQ within one delivery cycle; SIMULATE_PII_IN_BODY=true drives the event-secrecy probe with a PII fixture body and asserts the event record whitelist enforces (no PII leak).",
+      "given": "the shared fixture with the T-3 seam active",
+      "when": "each named induced-failure switch is set in turn and the paired probe runs",
+      "then": "SIMULATE_CONSUMER_RETRY true yields retry-and-dlq report with attempt-counter increments to 3 and messageDeadLettered fires; SIMULATE_DLQ_OVERFLOW true yields retry-and-dlq report reaching DLQ on first cycle with aggregateVerdict pass; SIMULATE_PII_IN_BODY true yields event-secrecy report with aggregateVerdict pass proving the whitelist blocks the PII leak (or fail if the whitelist is bypassed); the fixture README documents each switch and the paired probe",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-4201-6",
+      "description": "The blueprint ships a sample-app fixture entry, a README, a CHANGELOG, a guide, and a docs/topics.md entry; the shelf-wide id-band registry table gains a messaging-queue-cloudflare row at US band 29101-29899 / ADR-TAC suffix block 30xx across every shipped blueprint's docs/topics.md; packages/rcf-lite/docs/blueprint-authoring.md section 6a capability-declaration table gains one row for queue naming the reserved messaging-queue-postgres sibling per infra round 5 spec section 5.6 and Baz decision 7.",
+      "given": "the shelf tree after this blueprint lands",
+      "when": "grep queries walk every blueprint's docs/topics.md and the section 6a table",
+      "then": "packages/rcf-lite/docs/blueprint-authoring.md contains a table row beginning | queue | with the reserved messaging-queue-postgres sibling note; every shipped blueprint's docs/topics.md carries a row beginning | messaging-queue-cloudflare | with the 29101-29899 band and 30xx suffix; blueprints/messaging-queue-cloudflare/README.md, CHANGELOG.md, guide/messaging-queue-cloudflare.md, docs/topics.md, and the extended packages/rcf-lite/test/fixtures/infra-s3-and-queue/ all exist; the fixture README names the wrangler dev incantation and three wired induced-failure switches",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "usId": "US-4201",
+  "prdId": "PRD-001",
+  "reqId": "REQ-042",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "The messaging-queue-cloudflare blueprint ships on the shelf with four wrangler-dev probes plus one accountBound real-account concurrency smoke"
+}

package/rcf/user-stories/us-4301.json

@@ -0,0 +1,78 @@
+{
+  "createdAt": "2026-09-06T20:28:34.000Z",
+  "updatedAt": "2026-09-06T20:28:34.000Z",
+  "asA": "shelf consumer applying the jobs-background v1.0.0 blueprint",
+  "iWant": "the shipped blueprint files with 22 contributions, five probes, an extension to the shared sample-app fixture wiring the jobs runtime and scheduler on top of the T-3 in-memory queue seam, plus gate-runnable proof that apply refuses on a bare project with exit 3 and the stable message id, --allow-no-queue-yet writes a sidecar note, and every probe passes on the canonical fixture state",
+  "soThat": "a rcf-lite project applying this blueprint gets a job-definition contract with retry policy and timeout, an elicited scheduler (inProcess for now, workerCron or external for shipped adapters, workflows reserved for v1.1.0), a metadata-only run-log event stream at four moments, and the backgroundJobs capability future consumer blueprints can compose on; the T-5 capability-consumer mechanism is exercised end to end through the queue-capability path with runtime-observable ACs proven by probes the HQ gate runs against the shared sample-app fixture",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-4301-1",
+      "description": "The shelf carries blueprints/jobs-background/blueprint.json declaring slug jobs-background, version 1.0.0, category jobs, 22 contributions in the 6 REQ / 9 US / 3 TAC / 4 ADR groups per infra round 5 spec section 5.4; capabilities is [backgroundJobs]; suggestedCompanions declares logging and errorHandling with spec section 5.4 reasons; providesRoles is absent; requiresAppliedCapabilities equals {capabilities:[queue],allowSkipFlag:allow-no-queue-yet,refusalMessageId:jobs-background-no-queue}; every ADR contribution entry carries a non-null standardsTraceClause per section 8a.2.",
+      "given": "the shelf tree after this blueprint lands",
+      "when": "jq queries against blueprints/jobs-background/blueprint.json",
+      "then": "jq .slug returns jobs-background; jq .version returns 1.0.0; jq .contributions | length returns 22; jq .capabilities returns [backgroundJobs]; jq .suggestedCompanions | length returns 2; jq .requiresAppliedCapabilities.capabilities returns [queue]; jq .requiresAppliedCapabilities.allowSkipFlag returns allow-no-queue-yet; jq .requiresAppliedCapabilities.refusalMessageId returns jobs-background-no-queue; jq .contributions[] | select(.kind==adr) | .standardsTraceClause returns a non-null string for every entry",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-4301-2",
+      "description": "rcf define blueprint add ./blueprints/jobs-background on a bare fresh init project with no queue-capability provider applied refuses with exit 3 and the stderr message opens with the tag [jobs-background-no-queue] and explicitly names messaging-queue-cloudflare as the shipped provider and --allow-no-queue-yet as the override, per infra round 5 spec section 10 Q3 default asserting BOTH exit code AND stable message id.",
+      "given": "a fresh rcf init scratch project with no applied blueprints",
+      "when": "rcf define blueprint add ./blueprints/jobs-background runs",
+      "then": "exit code is 3; stderr contains the substring [jobs-background-no-queue]; stderr contains the substring messaging-queue-cloudflare; stderr contains the substring --allow-no-queue-yet; nothing is written to rcf/manifest.json under blueprints[] for jobs-background",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-4301-3",
+      "description": "rcf define blueprint add ./blueprints/jobs-background --allow-no-queue-yet on the same bare project exits 0 and writes the sidecar rcf/blueprints/jobs-background.applied.json with allowNoAuthYet true, appliedCapabilities [], and a notes field naming the missing queue capability and the --allow-no-queue-yet override flag (queue-family prose, not auth-family prose); the T-5 mechanism's shipped sidecar path supersedes the spec section 5.4 prose reference to manifest.blueprints[jobs-background].source.notes because the applied-blueprint-record schema in rcf-schemas 0.6.1 is closed and cannot carry the notes field.",
+      "given": "a fresh rcf init scratch project with no applied blueprints",
+      "when": "rcf define blueprint add ./blueprints/jobs-background --allow-no-queue-yet runs",
+      "then": "exit code is 0; the file rcf/blueprints/jobs-background.applied.json exists; its slug is jobs-background; its allowNoAuthYet is true; its appliedCapabilities is []; its notes contains the substring no queue yet and the substring --allow-no-queue-yet and the substring queue; its notes does NOT contain the substring no auth yet nor no secrets-management yet",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-4301-4",
+      "description": "rcf define blueprint add ./blueprints/jobs-background on a fresh init project that first applied messaging-queue-cloudflare exits 0 and the sidecar rcf/blueprints/jobs-background.applied.json records appliedCapabilities containing queue via the T-5 capability discovery mechanism (union across applied blueprint capability declarations); the spec section 5.4 prose reference to jq '.blueprints[] | select(.slug==\"jobs-background\") | .appliedCapabilities' rcf/manifest.json is superseded by the shipped mechanism which lives on the sidecar.",
+      "given": "a fresh rcf init scratch project with messaging-queue-cloudflare applied first",
+      "when": "rcf define blueprint add ./blueprints/jobs-background runs",
+      "then": "exit code is 0; the file rcf/blueprints/jobs-background.applied.json exists; its slug is jobs-background; its appliedCapabilities contains the string queue; its allowNoAuthYet is undefined; its notes is undefined",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-4301-5",
+      "description": "Every probe module under blueprints/jobs-background/contributions/probes/ exports the spec section 3.2 verdict envelope with an anchorAcId matching a contributed AC id on the blueprint (apply-time-refusal.mjs anchorAcId AC-jobs-requiresQueue, apply-time-override.mjs AC-jobs-overrideRecorded, fake-clock-cron.mjs AC-jobs-scheduledRunsOnCron, retry-and-fail.mjs AC-jobs-retryOnHandlerFailure, event-secrecy.mjs AC-jobs-eventSecrecy); every run-<probe-name>.mjs shim exits 0 on a fresh run of the shared sample-app fixture with the T-3 in-memory queue seam active; every per-blueprint report at .rcf/reports/blueprints/jobs-background/<probe-name>.json carries aggregateVerdict pass.",
+      "given": "the shared sample-app fixture at packages/rcf-lite/test/fixtures/infra-s3-and-queue/ with the T-3 in-memory queue-driver seam active (SDR-3-a coordinator ruling: wrangler dev is not on this build host and the in-memory realisation of the Cloudflare Queues binding shape is the shipped local seam)",
+      "when": "each of the five run-<probe-name>.mjs shims runs against the fixture in sequence",
+      "then": "every shim exits 0; every per-blueprint report file carries aggregateVerdict pass; every result carries an anchorAcId matching a contributed AC id on the blueprint",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-4301-6",
+      "description": "The shared sample-app fixture at packages/rcf-lite/test/fixtures/infra-s3-and-queue/ grows a jobs/ directory carrying two toy job-definition modules (send-welcome-email.mjs with retryPolicy {maxAttempts:3,backoff:exponential} and timeoutMs 60000, refresh-cache.mjs with retryPolicy {maxAttempts:5,backoff:constant} timeoutMs 10000 and cron every-minute), src/jobs-runtime.mjs realising the run-time (reads applied capabilities from the sidecar, registers job handlers with the queue consumer, fires the four lifecycle events per REQ-005), src/scheduler.mjs realising the inProcess scheduler with a fake-clock seam; two induced-failure switches SIMULATE_HANDLER_THROW and SIMULATE_PII_IN_JOB_INPUT are WIRED and driven live by the retry-and-fail.mjs and event-secrecy.mjs probes; the fixture README documents the two toy jobs, the jobs/ convention, the fake-clock switch, the elicited parameters and both induced-failure switches with paired probes.",
+      "given": "the shared fixture with the T-3 in-memory queue-driver seam and the T-4 jobs-runtime+scheduler wired on top",
+      "when": "each of the two induced-failure switches is set in turn and the paired probe runs",
+      "then": "SIMULATE_HANDLER_THROW true yields retry-and-fail report with attempts counter 1,2,3 across three jobStarted events with the same jobId followed by jobFailed with terminal code; SIMULATE_PII_IN_JOB_INPUT true yields event-secrecy report with aggregateVerdict pass proving the event whitelist blocks every PII input field; the fixture README documents each switch and the paired probe module by name",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-4301-7",
+      "description": "The blueprint ships a README, a CHANGELOG, a guide, and a docs/topics.md entry; the shelf-wide id-band registry table gains a jobs-background row at US band 30101-30899 / ADR-TAC suffix block 31xx across every shipped blueprint's docs/topics.md; packages/rcf-lite/docs/blueprint-authoring.md section 6a capability-declaration table gains one row for backgroundJobs naming the reserved sibling posture per infra round 5 spec section 5.6.",
+      "given": "the shelf tree after this blueprint lands",
+      "when": "grep queries walk every blueprint's docs/topics.md and the section 6a table",
+      "then": "packages/rcf-lite/docs/blueprint-authoring.md contains a table row beginning | backgroundJobs | naming jobs-background and the reserved sibling posture; every shipped blueprint's docs/topics.md carries a row beginning | jobs-background | with the 30101-30899 band and 31xx suffix; blueprints/jobs-background/README.md, CHANGELOG.md, guide/jobs-background.md, docs/topics.md, and the extended packages/rcf-lite/test/fixtures/infra-s3-and-queue/ all exist; the fixture README names the jobs-runtime boot line and the two wired induced-failure switches",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "usId": "US-4301",
+  "prdId": "PRD-001",
+  "reqId": "REQ-043",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "The jobs-background blueprint ships on the shelf with five probes wired to the T-3 in-memory queue seam"
+}

package/releases/releases.yaml

@@ -40,8 +40,28 @@
 # `npm install rcf-lite`.
 
 feedVersion: 1
-latest: "0.21.0"
+latest: "0.23.0"
 releases:
+  - version: "0.23.0"
+    date: "2026-09-07"
+    breaking: false
+    headlines:
+      - "rcf-lite 0.23.0 adds the infrastructure spine four blueprints wide: a Postgres store with a facade contract and forward-only migrations, an S3-shape object store with a Cloudflare R2 first adapter, a Cloudflare Queues producer and consumer with dead-letter semantics, and a background-jobs discipline that refuses to apply until a queue is applied."
+      - "Each blueprint verifies against the real engine with node-only probes, and the four surfaces compose through the capability mechanism the round-3 admin console shipped."
+      - "Also in this release: the deploy-cloudflare-workers blueprint bumps 1.1.0 to 1.2.0 to bless the Workers-with-static-assets shape as the SPA-on-Workers deploy shape, and a CLI stdout-flush fix so large outputs are not truncated at the pipe buffer."
+    minAgentAction: null
+    notesUrl: "https://stravica.ai/docs/rcf/changelog/"
+
+  - version: "0.22.0"
+    date: "2026-09-07"
+    breaking: false
+    headlines:
+      - "rcf-lite 0.22.0 fills the visual shelf with five application blueprints (empty and error states, file upload with a WCAG keyboard gate, a multi-step forms wizard, a self-service account settings area, and a first-run onboarding tour)."
+      - "Account settings reuses the admin-console capability-gating mechanism, so the five settings surfaces only render when the applied auth blueprint declares the capability."
+      - "The four shipped auth blueprints and the logging blueprint pick up additive capability declarations in the same release."
+    minAgentAction: null
+    notesUrl: "https://stravica.ai/docs/rcf/changelog/"
+
   - version: "0.21.0"
     date: "2026-09-05"
     breaking: false

package/src/blueprint/apply.js

@@ -393,7 +393,19 @@ export async function applyBlueprint({ projectRoot, tree, source, displaySource,
       appliedElicitations,
       allowNoAuthYet: allowNoAuthYet === true ? true : undefined,
       notes: allowNoAuthYet === true
-        ? `no auth yet: applied under --${blueprint.requiresAppliedCapabilities?.allowSkipFlag ?? 'allow-no-auth-yet'}; surfaces gated on ${(blueprint.requiresAppliedCapabilities?.capabilities ?? []).join(', ')} will refuse at runtime until an auth blueprint is applied.`
+        ? (function buildOverrideNote() {
+            const flag = blueprint.requiresAppliedCapabilities?.allowSkipFlag ?? 'allow-no-auth-yet';
+            const caps = (blueprint.requiresAppliedCapabilities?.capabilities ?? []).join(', ');
+            // Predecessor-family prose is derived from the flag name so
+            // the note reads sensibly for the auth override, the secrets
+            // override, and the queue override (infra round 5 T-4)
+            // without the runner learning the family list. New families
+            // extend by pattern-matching a substring of the flag name.
+            const family = flag.includes('secrets')
+              ? 'secrets-management'
+              : (flag.includes('queue') ? 'queue' : 'auth');
+            return `no ${family} yet: applied under --${flag}; surfaces gated on ${caps} will refuse at runtime until a ${family} blueprint is applied.`;
+          })()
         : undefined,
     });
   }

package/src/blueprint/capabilities.js

@@ -112,10 +112,74 @@ export function buildRefusalMessage({ slug, refusalMessageId, requiredCapabiliti
       `       rcf define blueprint add ${slug} --${allowSkipFlag}`,
     ].join('\n');
   }
+  if (refusalMessageId === 'application-account-settings-bare-spa') {
+    return [
+      `${slug} requires at least one applied security-auth-* blueprint,`,
+      `or an operator override with --${allowSkipFlag}.`,
+      '',
+      'Applied blueprints on this project:',
+      appliedBlock,
+      '',
+      'Suggested next steps:',
+      '  1. Apply an auth blueprint first:',
+      '       rcf define blueprint add security-auth-magic-link',
+      '     (or security-auth-clerk, security-auth-oauth2, security-auth-keycloak)',
+      `  2. Override for a scaffolding pass (surfaces will refuse at apply until an`,
+      `     auth blueprint is applied):`,
+      `       rcf define blueprint add ${slug} --${allowSkipFlag}`,
+    ].join('\n');
+  }
+  if (refusalMessageId === 'jobs-background-no-queue') {
+    // Infra round 5 T-4 (spec 5.4, Baz decision 5). Names the shipped
+    // queue provider explicitly (messaging-queue-cloudflare v1.0.0) so
+    // an operator hitting the refusal has the shipped answer in hand
+    // without a shelf-wide grep. Q3 default per spec section 10: the
+    // refusal asserts both exit code AND stable message id.
+    return [
+      `[jobs-background-no-queue] ${slug} requires an applied blueprint declaring`,
+      `at least one of: ${requiredCapabilities.join(', ')}`,
+      `or an operator override with --${allowSkipFlag}.`,
+      `The shipped provider is messaging-queue-cloudflare (v1.0.0+); a future`,
+      `messaging-queue-postgres sibling (Baz decision 7) will provide the same`,
+      `capability when demand mints it.`,
+      '',
+      'Applied blueprints on this project:',
+      appliedBlock,
+      '',
+      'Suggested next steps:',
+      '  1. Apply messaging-queue-cloudflare first:',
+      '       rcf define blueprint add messaging-queue-cloudflare',
+      `  2. Or override for a scaffolding pass (records a note on the applied`,
+      `     sidecar so later validation flags the surface as not-yet-activated):`,
+      `       rcf define blueprint add ${slug} --${allowSkipFlag}`,
+    ].join('\n');
+  }
+  if (refusalMessageId === 'object-storage-s3-no-secrets') {
+    return [
+      `[object-storage-s3-no-secrets] ${slug} requires an applied blueprint declaring`,
+      `at least one of: ${requiredCapabilities.join(', ')}.`,
+      `The shipped predecessor is security-secrets-management (v1.0.1+); the credential`,
+      `pair is a secretRef opaque string, never a value (infra round 5 spec 5.2, Baz`,
+      `decision 6).`,
+      '',
+      'Applied blueprints on this project:',
+      appliedBlock,
+      '',
+      'Suggested next steps:',
+      '  1. Apply security-secrets-management first:',
+      '       rcf define blueprint add security-secrets-management',
+      `  2. Or override for a scaffolding pass (records a note on source.notes so`,
+      `     later validation flags the surface as not-yet-activated):`,
+      `       rcf define blueprint add ${slug} --${allowSkipFlag}`,
+    ].join('\n');
+  }
   // Generic fallback. Names the required capabilities and applied set;
-  // the operator has enough to diagnose without a bespoke template.
+  // the operator has enough to diagnose without a bespoke template. The
+  // refusalMessageId is echoed on the first line as a stable dashboard-
+  // friendly tag downstream lint / dashboards can bind to.
+  const tag = refusalMessageId ? `[${refusalMessageId}] ` : '';
   return [
-    `${slug} requires an applied blueprint declaring at least one of:`,
+    `${tag}${slug} requires an applied blueprint declaring at least one of:`,
     `  ${requiredCapabilities.join(', ')}`,
     `or an operator override with --${allowSkipFlag}.`,
     '',

package/src/cli/blueprint.js

@@ -190,6 +190,18 @@ const OPTION_SPEC = {
   // repeatable; --answers <file> reads a JSON object mapping elicit
   // ids to values. Both feed the elicitation phase in applyBlueprint.
   'allow-no-auth-yet': { type: 'boolean' },
+  // Infra round 5 T-2 (spec 5.2, Baz decision 6): object-storage-s3
+  // declares allowSkipFlag "allow-no-secrets-yet" so the override for
+  // its requiresAppliedCapabilities gate stays semantically aligned
+  // with the credential-pair discipline the spec names, rather than
+  // reusing the auth-flavoured flag.
+  'allow-no-secrets-yet': { type: 'boolean' },
+  // Infra round 5 T-4 (spec 5.4, Baz decision 5): jobs-background
+  // declares allowSkipFlag "allow-no-queue-yet" so the override for
+  // its requiresAppliedCapabilities gate stays semantically aligned
+  // with the queue-capability discipline the spec names, rather than
+  // reusing the auth or secrets flavoured flags.
+  'allow-no-queue-yet': { type: 'boolean' },
   answer: { type: 'string', multiple: true },
   answers: { type: 'string' },
 };
@@ -339,7 +351,9 @@ export async function main(argv, deps = {}) {
     const result = await applyBlueprint({
       projectRoot, tree, source,
       namespaceOverride: parsed.values.namespace,
-      allowNoAuthYet: parsed.values['allow-no-auth-yet'] === true,
+      allowNoAuthYet: parsed.values['allow-no-auth-yet'] === true
+        || parsed.values['allow-no-secrets-yet'] === true
+        || parsed.values['allow-no-queue-yet'] === true,
       elicitAnswers,
       customAuthReadLine,
       // Library-qualified resolves rewire the applied identity under