rcf-lite 0.22.0 → 0.24.0

package/blueprints/edge-cloudflare-turnstile/contributions/user-stories/edge-cloudflare-turnstile-us-35102.json

@@ -0,0 +1,27 @@
+{
+  "usId": "edge-cloudflare-turnstile-US-35102",
+  "prdId": "PRD-001",
+  "reqId": "edge-cloudflare-turnstile-REQ-002",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Server-side siteverify with the always-pass secret returns success true and the handler proceeds with 200",
+  "asA": "shelf consumer whose Worker verifies every Turnstile token server-side",
+  "iWant": "a POST to https://challenges.cloudflare.com/turnstile/v0/siteverify with the pinned always-pass secret (1x0000000000000000000000000000000AA) and any response token to return success:true and the handler to respond 200",
+  "soThat": "the verified path is exercised end-to-end against the live Cloudflare endpoint on every gate run",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-35102-1",
+      "description": "A live POST to https://challenges.cloudflare.com/turnstile/v0/siteverify with secret=1x0000000000000000000000000000000AA and any response token returns success:true; the pack-fixture /api/submit handler proceeds with 200 and the shipped Node probe siteverify-fixture asserts success:true.",
+      "given": "the pack fixture running on 127.0.0.1 on a free port with the pinned always-pass secret in the environment",
+      "when": "a submit hits /api/submit with any response token",
+      "then": "the server-side POST to siteverify returns success:true and the handler responds 200",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-3602-edge-cloudflare-turnstile-server-verifier"
+  ],
+  "createdAt": "2026-09-07T20:00:00.000Z",
+  "updatedAt": "2026-09-07T20:00:00.000Z"
+}

package/blueprints/edge-cloudflare-turnstile/contributions/user-stories/edge-cloudflare-turnstile-us-35103.json

@@ -0,0 +1,27 @@
+{
+  "usId": "edge-cloudflare-turnstile-US-35103",
+  "prdId": "PRD-001",
+  "reqId": "edge-cloudflare-turnstile-REQ-002",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Server-side siteverify with the always-fail secret returns success false, the handler rejects 400, refusal body carries error-codes and no sitekey",
+  "asA": "shelf consumer whose Worker fails safe on every Turnstile refusal",
+  "iWant": "a POST to siteverify with the pinned always-fail secret to return success:false, the handler to reject with 400, and the refusal body to carry the documented error-codes value and never the sitekey",
+  "soThat": "every failure branch produces a stable machine-observable outcome and never leaks the sitekey or the response token",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-35103-1",
+      "description": "A live POST to siteverify with secret=2x0000000000000000000000000000000AA (always-fail secret per https://developers.cloudflare.com/turnstile/troubleshooting/testing/) returns success:false; the pack-fixture /api/submit handler rejects with 400 whose body carries the error-codes value (invalid-input-response) and no sitekey or secret substring.",
+      "given": "the pack fixture running with the pinned always-fail secret in the environment",
+      "when": "a submit hits /api/submit with any response token and the verifier calls siteverify",
+      "then": "siteverify returns success:false and the handler responds 400 with an error-codes body and no sitekey leak",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-3602-edge-cloudflare-turnstile-server-verifier"
+  ],
+  "createdAt": "2026-09-07T20:00:00.000Z",
+  "updatedAt": "2026-09-07T20:00:00.000Z"
+}

package/blueprints/edge-cloudflare-turnstile/contributions/user-stories/edge-cloudflare-turnstile-us-35104.json

@@ -0,0 +1,27 @@
+{
+  "usId": "edge-cloudflare-turnstile-US-35104",
+  "prdId": "PRD-001",
+  "reqId": "edge-cloudflare-turnstile-REQ-003",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Refuse-if-token-missing guard rejects submit with 400 before any downstream handler runs",
+  "asA": "shelf consumer whose Worker rejects cheap missing-token submit attempts at the earliest possible boundary",
+  "iWant": "a source-tree scan to enumerate every elicited surface and confirm each carries a token-required guard, and a live missing-token submit to be refused with 400 with no downstream side-effect",
+  "soThat": "no downstream handler ever executes against a missing-token submit",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-35104-1",
+      "description": "The Node probe guard-shape-scan enumerates every elicited surface in the pack fixture source and asserts each is registered under the token-required guard. A live POST to /api/submit without a Cf-Turnstile-Response field is rejected with 400 and refusal body carries error-code turnstile.token-missing; no downstream handler side-effect is observable.",
+      "given": "the pack fixture running with every elicited surface registered under the token-required guard",
+      "when": "a submit reaches /api/submit without a Cf-Turnstile-Response value",
+      "then": "the guard rejects with 400 with an error-code body and no downstream handler runs",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-3602-edge-cloudflare-turnstile-server-verifier"
+  ],
+  "createdAt": "2026-09-07T20:00:00.000Z",
+  "updatedAt": "2026-09-07T20:00:00.000Z"
+}

package/blueprints/edge-cloudflare-turnstile/contributions/user-stories/edge-cloudflare-turnstile-us-35105.json

@@ -0,0 +1,36 @@
+{
+  "usId": "edge-cloudflare-turnstile-US-35105",
+  "prdId": "PRD-001",
+  "reqId": "edge-cloudflare-turnstile-REQ-004",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Composition with security-auth-magic-link gates the magic-link mint surface behind the Turnstile guard",
+  "asA": "shelf consumer applying both security-auth-magic-link and edge-cloudflare-turnstile",
+  "iWant": "the magic-link mint surface to be registered under the Turnstile guard so a mint submit reads through the same token check as any other elicited surface, and a mint without a valid Turnstile token to be refused with 400 before the mint fires",
+  "soThat": "magic-link mint requests are protected by the same human-check as any other public form",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-35105-1",
+      "description": "The pack fixture ships a /api/magic-link mint stub route registered under the Turnstile guard. A source-tree read of the composition wire confirms the mint surface reads the Turnstile guard before invoking the magic-link mint.",
+      "given": "the pack fixture with both blueprints applied and /api/magic-link registered under the token-required guard",
+      "when": "the composition wire is walked in the source tree",
+      "then": "the magic-link mint surface reads the Turnstile guard before invoking the mint",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-35105-2",
+      "description": "A live POST to /api/magic-link without a Cf-Turnstile-Response field, and a POST carrying the always-fail response token that fails siteverify, are both refused with 400 by the Turnstile guard and no magic-link mint side-effect is observable. The Playwright pack check magicLinkGuard drives this against the fixture with a real browser.",
+      "given": "the pack fixture running with both blueprints applied and a real Playwright browser driving the fixture",
+      "when": "a magic-link mint submit is issued without a Turnstile response, or with the always-fail response token",
+      "then": "the Turnstile guard refuses with 400 and no magic-link mint side-effect is observable",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-3603-edge-cloudflare-turnstile-magic-link-hook"
+  ],
+  "createdAt": "2026-09-07T20:00:00.000Z",
+  "updatedAt": "2026-09-07T20:00:00.000Z"
+}

package/blueprints/edge-cloudflare-turnstile/contributions/user-stories/edge-cloudflare-turnstile-us-35106.json

@@ -0,0 +1,27 @@
+{
+  "usId": "edge-cloudflare-turnstile-US-35106",
+  "prdId": "PRD-001",
+  "reqId": "edge-cloudflare-turnstile-REQ-005",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Widget mode is elicited as an enum (managed, non-interactive, invisible); default managed and each mode renders per Cloudflare documented modes",
+  "asA": "shelf consumer selecting a Turnstile widget mode for the applied surface",
+  "iWant": "to elicit one of managed, non-interactive or invisible at apply time with managed as the recommendedDefault, and to see each mode render as Cloudflare documents",
+  "soThat": "the applied widget mode matches the operational profile my site needs",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-35106-1",
+      "description": "The blueprint elicit widget-mode is enum with values managed, non-interactive, invisible; recommendedDefault managed per ADR-3602. The pack fixture accepts ?mode=<managed|non-interactive|invisible> and mounts the widget with the pinned invisible-widget test sitekeys (1x00000000000000000000BB, 2x00000000000000000000BB per https://developers.cloudflare.com/turnstile/troubleshooting/testing/). Each mode renders the Turnstile iframe from https://challenges.cloudflare.com and no other origin.",
+      "given": "the pack fixture loaded with mode=managed, mode=non-interactive and mode=invisible respectively",
+      "when": "each variant renders",
+      "then": "each renders the Turnstile widget from Cloudflare Turnstile origin only and no third-party script is loaded",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-3601-edge-cloudflare-turnstile-widget-mount"
+  ],
+  "createdAt": "2026-09-07T20:00:00.000Z",
+  "updatedAt": "2026-09-07T20:00:00.000Z"
+}

package/blueprints/edge-cloudflare-turnstile/contributions/user-stories/edge-cloudflare-turnstile-us-35107.json

@@ -0,0 +1,27 @@
+{
+  "usId": "edge-cloudflare-turnstile-US-35107",
+  "prdId": "PRD-001",
+  "reqId": "edge-cloudflare-turnstile-REQ-002",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "TURNSTILE_SECRET is read only via the applied secrets facade and never inlined in fixture source",
+  "asA": "reviewer auditing the applied Workers project for secret hygiene",
+  "iWant": "the TURNSTILE_SECRET to be dereferenced only via process.env or an env-shaped facade and no plain-text secret literal in the fixture source",
+  "soThat": "the Turnstile secret is never committed to the applying project source tree",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-35107-1",
+      "description": "A source-tree AST scan of the pack fixture (packages/rcf-lite/test/fixtures/probe-pack-edge-cloudflare-turnstile) asserts that TURNSTILE_SECRET is read only via env-shaped identifiers (process.env.TURNSTILE_SECRET or an env facade) and that no plain-string secret literal appears in the fixture source; the Node probe secret-shape-scan implements the assertion and exits 0.",
+      "given": "the shipped pack fixture with the pinned test secrets sourced from environment",
+      "when": "the source-tree AST scan runs over the fixture",
+      "then": "the scan finds only env-shaped reads for TURNSTILE_SECRET and reports no plain-string secret literal",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-3602-edge-cloudflare-turnstile-server-verifier"
+  ],
+  "createdAt": "2026-09-07T20:00:00.000Z",
+  "updatedAt": "2026-09-07T20:00:00.000Z"
+}

package/blueprints/edge-cloudflare-turnstile/contributions/user-stories/edge-cloudflare-turnstile-us-35108.json

@@ -0,0 +1,27 @@
+{
+  "usId": "edge-cloudflare-turnstile-US-35108",
+  "prdId": "PRD-001",
+  "reqId": "edge-cloudflare-turnstile-REQ-002",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Event records carry sitekeyHash, outcome and timestamp only; no token and no secret",
+  "asA": "reviewer auditing the applied Workers project for observability hygiene",
+  "iWant": "every event record produced by a Turnstile verification to carry sitekeyHash, outcome and timestamp only and never carry the token or the secret value",
+  "soThat": "the observability tier never sees the raw Turnstile response or the Turnstile secret",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-35108-1",
+      "description": "The Node probe event-secrecy drives siteverify against Cloudflare with the pinned test keys and asserts every event record carries {sitekeyHash, outcome, timestamp} keys only; no record carries the token, no record carries the secret, and no forbidden substring is present in the serialised record.",
+      "given": "the pack fixture running with the event-secrecy probe attached and the pinned test keys in the environment",
+      "when": "the probe drives one pass and one fail through the verifier",
+      "then": "every emitted event carries only sitekeyHash, outcome and timestamp",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-3602-edge-cloudflare-turnstile-server-verifier"
+  ],
+  "createdAt": "2026-09-07T20:00:00.000Z",
+  "updatedAt": "2026-09-07T20:00:00.000Z"
+}

package/blueprints/edge-cloudflare-turnstile/docs/topics.md

@@ -0,0 +1,68 @@
+# edge-cloudflare-turnstile blueprint coordination vocabulary
+
+This file is the edge-cloudflare-turnstile half of the cross-blueprint contract. The Phase 1 conflict detector matches scope:global ADR topics by EXACT string equality, and AC ids are unnamespaced by the 0.4.4 grammar. Any blueprint intended to compose with this one must reuse these exact strings and respect these bands.
+
+## Global ADR topics this blueprint contributes (exact strings)
+
+| Topic string | edge-cloudflare-turnstile contribution | Origin | Composition note |
+|---|---|---|---|
+| `humanVerificationGate` | ADR-3601-edge-cloudflare-turnstile-verifier-contract | Minted by this blueprint. Names the wire-shape contract for the project-wide human verification gate; the shipped answer is Cloudflare Turnstile with server-side siteverify per `https://developers.cloudflare.com/turnstile/`. | The one project-wide decision on the human verification gate at the shipped-shape boundary. A future non-Cloudflare sibling (hCaptcha, reCAPTCHA) would contribute the same topic string with a different answer, forcing a DELIBERATE conflict the operator resolves with a project-level ADR. |
+
+The edge-cloudflare-turnstile blueprint claims one global topic (minted here, shipped as the Cloudflare Turnstile siteverify verifier). ADR-3602 widget mode and ADR-3603 refuse shape do not contribute global topics; a composing blueprint that holds an opinion on either authors its own project-level ADR.
+
+Rules for new topics: lower camel case, one concept per topic, no version suffixes. A topic names the decision area, not the chosen answer.
+
+## Id number bands (registry bootstrap)
+
+This table is maintained shelf-wide across every blueprint's `docs/topics.md`. Rows are recorded at ship, never predicted.
+
+| Blueprint | US band | ADR/TAC suffix block | Status | Global topics |
+|---|---|---|---|---|
+| application-spa | 1101-1899 | 2xx | shipped v1.3.0 | `clientRouting`, `theming`, `clientState`, `errorEnvelope`, `authModel` |
+| application-api-rest | 2101-2899 | 3xx | shipped v1.0.0 | `errorEnvelope`, `authModel`, `apiVersioning`, `logging` |
+| security-auth-magic-link | 3101-3899 | 5xx | shipped v1.2.0 | `authModel` |
+| email-smtp-resend | 4101-4899 | 4xx | shipped v1.0.0 | none |
+| hello-panel (walkthrough exemplar) | 4101-4899 | 4xx | doc-reserved; teaching exemplar in `packages/rcf-lite/docs/blueprint-authoring-walkthrough.md`, not shipped as a blueprint directory | `operatorPanel` |
+| persistence-data-sqlite | 5101-5899 | 6xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
+| delivery-ci-workflows | 6101-6899 | 7xx | shipped v2.0.0 (renamed from ci-pipeline) | `ciGates`, `strictCoverageGate`, `releaseArtefacts` |
+| observability-essentials | 7101-7899 | 8xx | shipped v2.0.0 | `statusPageContract` |
+| security-secrets-management | 8101-8899 | 9xx | shipped v1.0.1 | `secretsSource` |
+| security-auth-clerk | 9101-9899 | 10xx | shipped v1.0.0 | `authModel` |
+| security-auth-oauth2 | 10101-10899 | 11xx | shipped v1.0.0 | `authModel` |
+| security-auth-keycloak | 11101-11899 | 12xx | shipped v1.0.0 | `authModel` |
+| deploy-cloudflare-workers | 12101-12899 | 13xx | shipped v1.2.0 | `deploymentTarget` |
+| persistence-data-d1 | 13101-13899 | 14xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
+| observability-probe-endpoints | 14101-14899 | 15xx | shipped v1.1.0 | `healthProbes`, `readinessSemantics` |
+| observability-logging | 15101-15899 | 16xx | shipped v1.0.0 | `logging` |
+| application-error-handling | 16101-16899 | 17xx | shipped v1.0.0 | `errorHandling` |
+| application-datatable | 17101-17899 | 18xx | shipped v1.0.0 | none |
+| application-charts | 18101-18899 | 19xx | shipped v1.0.0 | none |
+| application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
+| application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
+| application-admin-console | 21101-21899 | 22xx | shipped v1.1.0 | `adminConsoleSignInSurface` |
+| application-empty-error-states | 22101-22899 | 23xx | shipped v1.0.0 | none |
+| application-file-upload | 23101-23899 | 24xx | shipped v1.0.0 | none |
+| application-forms-wizard | 24101-24899 | 25xx | shipped v1.0.0 | none |
+| application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
+| application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
+| persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
+| jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
+| platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |
+| platform-cloudflare-cron-triggers | 32101-32899 | 33xx | shipped v1.0.0 | `scheduledTriggerContract` |
+| platform-cloudflare-durable-objects | 33101-33899 | 34xx | shipped v1.0.0 | `strongConsistencyCellContract`, `websocketHubContract` |
+| edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
+| edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
+| edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
+
+US 35101-35108 sit at the LOW end of the 35101-35899 band on purpose (watchpost run-4 lesson). ADR/TAC suffixes for this blueprint use the 3601-3699 block, continuing the shelf pattern.
+
+## Shared expectations for future composing blueprints
+
+- Reuse `humanVerificationGate` exactly as spelled here when your blueprint holds an opinion on the human verification gate contract; contribute your own scope:global ADR on that string and let composition surface the pairing.
+- Consumer blueprints reading the `humanCheck` capability declared on `blueprint.json` per section 6a of `blueprint-authoring.md` obtain the Turnstile-guarded composition at apply time via the capability-declaration mechanism.
+
+## Deliberate-conflict statement
+
+This blueprint's ADR-3601 on `humanVerificationGate` is the first shipped answer to a topic that will conflict, by design, with future non-Cloudflare siblings. Applying `edge-cloudflare-turnstile` alongside such a sibling would raise a `globalAdrTopic` conflict the operator resolves via one of the four documented resolutions (adopt one, keep the existing one, author a project-level supersede ADR, or `--resolve <topic>=project:<ADR-id>` on the add).

package/blueprints/edge-cloudflare-turnstile/guide/edge-cloudflare-turnstile.md

@@ -0,0 +1,104 @@
+# edge-cloudflare-turnstile guide
+
+This guide walks the operator through applying the `edge-cloudflare-turnstile` v1.0.0 blueprint to a Workers project, wiring the client widget mount, calling the server-side siteverify, refusing missing-token submits, and composing the guard with `security-auth-magic-link` on the mint surface.
+
+## 1. Prerequisites
+
+- A Cloudflare Turnstile widget (sitekey and paired secret). Cloudflare documents issuing at `https://developers.cloudflare.com/turnstile/`. For CI and development, the fixture pins the always-pass and always-fail public test keys documented at `https://developers.cloudflare.com/turnstile/troubleshooting/testing/`.
+- A Cloudflare Workers project (`deploy-cloudflare-workers` applied) or the shipped pack fixture at `packages/rcf-lite/test/fixtures/probe-pack-edge-cloudflare-turnstile/`.
+
+## 2. Apply the blueprint
+
+At apply time the blueprint elicits four values:
+
+| Elicit | Answer |
+|---|---|
+| `turnstile-sitekey` | The Cloudflare Turnstile sitekey the widget renders with. |
+| `turnstile-secret` | The paired secret. Store through the applied `security-secrets-management` companion. |
+| `turnstile-widget-mode` | One of `managed` (default), `non-interactive`, `invisible`. |
+| `turnstile-guarded-surfaces` | Comma-separated list of applied route ids the guard registers on. |
+
+## 3. Client widget mount snippet
+
+Paste the following into the public form surface. The mount injects Cloudflare Turnstile JS from `https://challenges.cloudflare.com` and populates the `cf-turnstile-response` hidden input on submit.
+
+```html
+<script src="https://challenges.cloudflare.com/turnstile/v0/api.js" async defer></script>
+<form method="post" action="/api/submit">
+  <label>Email <input type="email" name="email" required></label>
+  <div class="cf-turnstile"
+       data-sitekey="YOUR_TURNSTILE_SITEKEY"
+       data-callback="onTurnstileToken"></div>
+  <button type="submit">Submit</button>
+</form>
+<script>
+window.onTurnstileToken = function (token) {
+  var f = document.querySelector('form');
+  var i = f.querySelector('input[name="cf-turnstile-response"]');
+  if (!i) {
+    i = document.createElement('input');
+    i.type = 'hidden';
+    i.name = 'cf-turnstile-response';
+    f.appendChild(i);
+  }
+  i.value = token;
+};
+</script>
+```
+
+## 4. Server-side siteverify
+
+Every submit is verified server-side by POSTing to Cloudflare's siteverify endpoint per `https://developers.cloudflare.com/turnstile/`. On `success:true` the handler proceeds; on `success:false` the handler rejects with 400 and the refusal body carries the documented `error-codes` value.
+
+`curl` example:
+
+```
+curl -sS -X POST https://challenges.cloudflare.com/turnstile/v0/siteverify \
+  -d "secret=$TURNSTILE_SECRET" \
+  -d "response=$CLIENT_TOKEN"
+```
+
+Response on pass:
+
+```
+{"success":true,"challenge_ts":"...","hostname":"..."}
+```
+
+Response on fail:
+
+```
+{"success":false,"error-codes":["invalid-input-response"]}
+```
+
+## 5. Refuse-if-token-missing guard
+
+Every elicited surface is registered under the token-required guard. A submit whose payload has no `cf-turnstile-response` field is refused with `400 {"errorCode":"turnstile.token-missing"}` before any downstream handler runs. The pack fixture (`packages/rcf-lite/test/fixtures/probe-pack-edge-cloudflare-turnstile/server.js`) is the reference wiring; the applied Worker mirrors the shape.
+
+## 6. Composition with security-auth-magic-link
+
+When `security-auth-magic-link` is also applied, the composition hook (`TAC-3603`) registers the magic-link mint route under the Turnstile guard. The mint reads the Turnstile token check before invoking the mint. Example:
+
+```
+POST /api/magic-link
+Content-Type: application/x-www-form-urlencoded
+
+email=alice@example.com&cf-turnstile-response=<TOKEN>
+```
+
+- Missing token: `400 {"errorCode":"turnstile.token-missing"}` with no mint side-effect.
+- Failed siteverify: `400 {"errorCode":"turnstile.siteverify-failed","errorCodes":[...]}` with no mint side-effect.
+- Pass: `200 {"mint":"ok"}` and the magic-link mint fires.
+
+## 7. Widget mode
+
+Cloudflare Turnstile documents three widget modes per `https://developers.cloudflare.com/turnstile/`: `managed` (Cloudflare decides when to render a challenge), `non-interactive` (always shows a non-interactive challenge) and `invisible` (invisible widget). The blueprint elicits the mode; the shipped default is `managed`.
+
+The pack fixture accepts `?mode=<managed|non-interactive|invisible>` for a per-page-load override.
+
+## 8. Test keys and CI
+
+For CI or development the fixture pins Cloudflare's public test keys per `https://developers.cloudflare.com/turnstile/troubleshooting/testing/`. The always-pass sitekey `1x00000000000000000000AA` and always-fail sitekey `2x00000000000000000000AB` drive the deterministic branches of the shipped probes. No real Turnstile credentials are required for the pack to run.
+
+## 9. Observability
+
+Every event record carries `sitekeyHash`, `outcome` and `timestamp` keys only. The token and the secret are never in the record. The `event-secrecy` probe asserts this shape on every apply.

package/blueprints/edge-cloudflare-turnstile/probe-packs/edge-cloudflare-turnstile.pack.mjs

@@ -0,0 +1,146 @@
+// edge-cloudflare-turnstile probe pack (v1.0.0).
+//
+// Four surface-observable checks per cloudflare-round-6-spec section 3.2:
+//   AC-turnstile-widgetRendered      Turnstile widget mounts with the pinned always-pass sitekey and the mount injects no third-party script beyond the Cloudflare Turnstile host.
+//   AC-turnstile-serverVerified-pass Live POST to Cloudflare siteverify with always-pass secret returns success:true and the handler responds 200.
+//   AC-turnstile-serverVerified-fail Live POST to Cloudflare siteverify with always-fail secret returns success:false and the handler rejects 400.
+//   AC-turnstile-magicLinkGuard      Magic-link mint route composed with the Turnstile guard refuses a mint submit without a valid Turnstile response with 400 and no mint side-effect.
+//
+// The pack ships no appliesTo predicate (Turnstile is not capability-gated per spec section 3.2). Every fixture
+// that applies the blueprint fires every check. Runtime URL and browser are supplied by the pack runner; the
+// dedicated pack fixture at packages/rcf-lite/test/fixtures/probe-pack-edge-cloudflare-turnstile pins the
+// Cloudflare public test keys documented at https://developers.cloudflare.com/turnstile/troubleshooting/testing/.
+
+function withUrl(runtimeUrl, path) {
+  return new URL(path, runtimeUrl).toString();
+}
+
+const CLOUDFLARE_TURNSTILE_ORIGIN = 'https://challenges.cloudflare.com';
+
+export default {
+  packName: 'edge-cloudflare-turnstile',
+  version: '1.0.0',
+  blueprintSlug: 'edge-cloudflare-turnstile',
+  appliesTo: () => true,
+  boot: { bootCommand: null, waitForUrl: null, waitForSelector: null },
+  checks: [
+    {
+      id: 'AC-turnstile-widgetRendered',
+      severity: 'block',
+      description: 'Turnstile client widget mounts with the pinned always-pass sitekey; the mount injects Cloudflare Turnstile JS from the Cloudflare Turnstile origin only, populates the Cf-Turnstile-Response token input, and no third-party script from any other origin is loaded on the page.',
+      run: async ({ browser, runtimeUrl }) => {
+        if (!browser) return { verdict: 'fail', detail: 'no packBrowser wired' };
+        await browser.goto(withUrl(runtimeUrl, '/?sitekey=pass'));
+        // Wait for the widget to inject the token. Turnstile fires the callback asynchronously and the always-pass
+        // test sitekey (1x00000000000000000000AA per Cloudflare testing docs) resolves without rendering an iframe.
+        await new Promise((r) => setTimeout(r, 6000));
+        const dom = await browser.evaluate((cfOrigin) => {
+          const widget = document.querySelector('[data-role="turnstile-widget"]');
+          const sitekeyEl = document.querySelector('[data-role="sitekey"]');
+          const scripts = Array.from(document.querySelectorAll('script[src]')).map((s) => s.src);
+          const cloudflareScripts = scripts.filter((s) => s.startsWith(cfOrigin));
+          const thirdParty = scripts.filter((s) => {
+            try { const u = new URL(s); if (u.origin === window.location.origin) return false; return u.origin !== cfOrigin; }
+            catch { return false; }
+          });
+          const tokenInputs = Array.from(document.querySelectorAll('input[name="cf-turnstile-response"]'));
+          const tokenValues = tokenInputs.map((i) => (i.value || '').slice(0, 8));
+          return {
+            widgetPresent: !!widget,
+            sitekey: sitekeyEl ? sitekeyEl.textContent.trim() : null,
+            scriptCount: scripts.length, cloudflareScriptCount: cloudflareScripts.length, thirdPartyScripts: thirdParty,
+            tokenInputCount: tokenInputs.length, tokenValueSample: tokenValues,
+            tokenPopulated: tokenInputs.some((i) => i.value && i.value.length > 0),
+          };
+        }, CLOUDFLARE_TURNSTILE_ORIGIN);
+        if (!dom.widgetPresent) return { verdict: 'fail', detail: 'Turnstile widget element [data-role="turnstile-widget"] not found on /?sitekey=pass' };
+        if (dom.cloudflareScriptCount < 1) return { verdict: 'fail', detail: `Cloudflare Turnstile JS not injected from ${cfOrigin}; scripts=${JSON.stringify(dom)}`.replace('${cfOrigin}', 'https://challenges.cloudflare.com') };
+        if (dom.thirdPartyScripts.length > 0) return { verdict: 'fail', detail: `third-party script(s) present beyond Cloudflare Turnstile: ${JSON.stringify(dom.thirdPartyScripts)}` };
+        if (dom.tokenInputCount < 1) return { verdict: 'fail', detail: `no cf-turnstile-response input in the page after widget mount; DOM=${JSON.stringify(dom)}` };
+        if (!dom.tokenPopulated) return { verdict: 'fail', detail: `cf-turnstile-response input not populated by Turnstile; token samples=${JSON.stringify(dom.tokenValueSample)}` };
+        return { verdict: 'pass', detail: `widget mounted; sitekey=${dom.sitekey}; cloudflareScripts=${dom.cloudflareScriptCount}; tokenPopulated=true tokenSample=${JSON.stringify(dom.tokenValueSample)}; thirdParty=0` };
+      },
+    },
+    {
+      id: 'AC-turnstile-serverVerified-pass',
+      severity: 'block',
+      description: 'Live POST to challenges.cloudflare.com/turnstile/v0/siteverify with the pinned always-pass secret returns success:true; the fixture /api/submit handler responds 200.',
+      run: async ({ browser, runtimeUrl }) => {
+        // Server-side siteverify pass. Uses the browser as a driver to build a form submission then reads
+        // the server response.
+        const body = new URLSearchParams();
+        body.set('email', 'reviewer@example.com');
+        body.set('turnstile-sitekey', '1x00000000000000000000AA');
+        body.set('cf-turnstile-response', 'PACK-CHECK-PASS-TOKEN');
+        const resp = await fetch(withUrl(runtimeUrl, '/api/submit'), {
+          method: 'POST', headers: { 'content-type': 'application/x-www-form-urlencoded' }, body,
+        });
+        const text = await resp.text();
+        let json = null; try { json = JSON.parse(text); } catch { /* leave null */ }
+        const ok = resp.status === 200 && json && json.received === 'ok';
+        return {
+          verdict: ok ? 'pass' : 'fail',
+          detail: ok
+            ? `serverVerified-pass: fixture /api/submit returned status=200 body=${text} (Cloudflare siteverify success:true with always-pass secret)`
+            : `serverVerified-pass unexpected shape status=${resp.status} body=${text}`,
+        };
+      },
+    },
+    {
+      id: 'AC-turnstile-serverVerified-fail',
+      severity: 'block',
+      description: 'Live POST to Cloudflare siteverify with the pinned always-fail secret returns success:false; the fixture /api/submit handler rejects with 400 and refusal body carries errorCodes and no sitekey.',
+      run: async ({ browser, runtimeUrl }) => {
+        const body = new URLSearchParams();
+        body.set('email', 'reviewer@example.com');
+        body.set('turnstile-sitekey', '2x00000000000000000000AB');
+        body.set('cf-turnstile-response', 'PACK-CHECK-FAIL-TOKEN');
+        const resp = await fetch(withUrl(runtimeUrl, '/api/submit?fail-secret=1'), {
+          method: 'POST', headers: { 'content-type': 'application/x-www-form-urlencoded' }, body,
+        });
+        const text = await resp.text();
+        let json = null; try { json = JSON.parse(text); } catch { /* leave null */ }
+        const ok = resp.status === 400 && json && json.errorCode === 'turnstile.siteverify-failed'
+          && Array.isArray(json.errorCodes) && json.errorCodes.length > 0
+          && !text.includes('2x00000000000000000000AB');
+        return {
+          verdict: ok ? 'pass' : 'fail',
+          detail: ok
+            ? `serverVerified-fail: fixture rejected status=400 errorCode=turnstile.siteverify-failed errorCodes=${JSON.stringify(json.errorCodes)}; refusal body carries no sitekey`
+            : `serverVerified-fail unexpected shape status=${resp.status} body=${text}`,
+        };
+      },
+    },
+    {
+      id: 'AC-turnstile-magicLinkGuard',
+      severity: 'block',
+      description: 'Magic-link mint route composed with the Turnstile guard refuses a mint submit without a Turnstile response with 400 and refusal errorCode=turnstile.token-missing; no magic-link mint side-effect.',
+      run: async ({ browser, runtimeUrl }) => {
+        // Two probes: (a) missing token refuse (400), (b) fail-secret refuse (400).
+        const missingBody = new URLSearchParams();
+        missingBody.set('email', 'reviewer@example.com');
+        missingBody.set('turnstile-sitekey', '1x00000000000000000000AA');
+        const missingResp = await fetch(withUrl(runtimeUrl, '/api/magic-link'), {
+          method: 'POST', headers: { 'content-type': 'application/x-www-form-urlencoded' }, body: missingBody,
+        });
+        const missingText = await missingResp.text();
+        let missingJson = null; try { missingJson = JSON.parse(missingText); } catch {}
+        const missingOk = missingResp.status === 400 && missingJson && missingJson.errorCode === 'turnstile.token-missing';
+
+        const failBody = new URLSearchParams();
+        failBody.set('email', 'reviewer@example.com');
+        failBody.set('turnstile-sitekey', '2x00000000000000000000AB');
+        failBody.set('cf-turnstile-response', 'MAGIC-LINK-PACK-FAIL-TOKEN');
+        const failResp = await fetch(withUrl(runtimeUrl, '/api/magic-link?fail-secret=1'), {
+          method: 'POST', headers: { 'content-type': 'application/x-www-form-urlencoded' }, body: failBody,
+        });
+        const failText = await failResp.text();
+        let failJson = null; try { failJson = JSON.parse(failText); } catch {}
+        const failOk = failResp.status === 400 && failJson && failJson.errorCode === 'turnstile.siteverify-failed';
+
+        if (missingOk && failOk) return { verdict: 'pass', detail: `magic-link guard: missing-token refused 400 turnstile.token-missing; fail-secret refused 400 turnstile.siteverify-failed errorCodes=${JSON.stringify(failJson.errorCodes)}` };
+        return { verdict: 'fail', detail: `magic-link guard unexpected: missing status=${missingResp.status} body=${missingText}; fail status=${failResp.status} body=${failText}` };
+      },
+    },
+  ],
+};

package/blueprints/email-smtp-resend/docs/topics.md

@@ -35,7 +35,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | application-charts | 18101-18899 | 19xx | shipped v1.0.0 | none |
 | application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
 | application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
-| application-admin-console | 21101-21899 | 22xx | shipped v1.0.0 | none |
+| application-admin-console | 21101-21899 | 22xx | shipped v1.1.0 | `adminConsoleSignInSurface` |
 | application-empty-error-states | 22101-22899 | 23xx | shipped v1.0.0 | none |
 | application-file-upload | 23101-23899 | 24xx | shipped v1.0.0 | none |
 | application-forms-wizard | 24101-24899 | 25xx | shipped v1.0.0 | none |
@@ -43,6 +43,14 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
 | persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
 | object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
+| jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
+| platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |
+| platform-cloudflare-cron-triggers | 32101-32899 | 33xx | shipped v1.0.0 | `scheduledTriggerContract` |
+| platform-cloudflare-durable-objects | 33101-33899 | 34xx | shipped v1.0.0 | `strongConsistencyCellContract`, `websocketHubContract` |
+| edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
+| edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
+| edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
 
 US 4101-4106 sit at the LOW end of the 4101-4899 band on purpose. A project-side story that mechanically derives from an email-smtp-resend REQ id into the number `4106` (leading `4` + sequence `106`) would collide against email-smtp-resend-US-4106 in this package; the band leaves headroom at the HIGH end (US 4181-4899) so a project's own stories anchored to email-smtp-resend REQs can allocate without conflict. The watchpost run4 lesson applies here too.
 

package/blueprints/jobs-background/CHANGELOG.md

@@ -0,0 +1,16 @@
+# jobs-background changelog
+
+## 1.0.0 - 2026-09-06
+
+Initial release. Background-jobs discipline over an applied `queue` capability, with a job-definition contract, a POSIX-cron plus one-shot-delayed scheduler, a retry contract that inherits the applied queue's max-attempts ceiling, and a metadata-only run-log event stream at four moments. Composes on the T-5 capability-consumer mechanism from the visual round; refuses apply on a bare project with exit 3 and the stable message id `jobs-background-no-queue` per Baz decision 5. Landed via the infra round 5 spec (ratified 2026-09-06) as track T-4, chained after T-3 `messaging-queue-cloudflare` v1.0.0.
+
+- 22 contributions: 6 REQs on `requiresAppliedCapabilities: [queue]` / job-definition / scheduler / retry / run-log / operator-facing surface; 9 USs at 30101-30109 (one per REQ plus three cross-cutting cases: apply-time refusal, scheduled fire on cron, retry-then-DLQ); 3 TACs (3101 job-definition module, 3102 scheduler, 3103 run-log event sink); 4 ADRs (3101 `scope: global` on new topic `backgroundJobModel` retry-and-schedule as the shipped shape, 3102 scheduler mode elicited across `inProcess` / `workerCron` / `external` with reserved v1.1.0 `workflows` slot per section 5.7 of the spec, 3103 requires `capabilities: ["queue"]` with `allowSkipFlag: "allow-no-queue-yet"` and refusal message id `jobs-background-no-queue`, 3104 default handler timeout 60 seconds floor 1 second ceiling bounded by the applied queue's consumer wall-clock which for Cloudflare Queues is 15 minutes per the fetched limits doc).
+- Five Node-only probes under `contributions/probes/` proven against the T-3 in-memory queue-driver seam and a fake-clock scheduler seam (SDR-3-a on US-29107 accepts the in-memory realisation of the Cloudflare Queues binding shape as the shipped local seam): `apply-time-refusal`, `apply-time-override`, `fake-clock-cron`, `retry-and-fail`, `event-secrecy`. All five carry `accountBound: false`; the live `wrangler dev` cron-trigger path is documented as a per-AC mechanism-reach gap in the fixture README per round-3 checklist 6.g.
+- T-4 slice of the shared sample-app fixture at `packages/rcf-lite/test/fixtures/infra-s3-and-queue/` adds a `jobs/` directory carrying two toy job-definition modules (`send-welcome-email.mjs` with `retryPolicy: { maxAttempts: 3, backoff: exponential }` and `timeoutMs: 60000`; `refresh-cache.mjs` with `retryPolicy: { maxAttempts: 5, backoff: constant }`, `timeoutMs: 10000`, `cron: '* * * * *'`), `src/jobs-runtime.mjs` realising the runtime, `src/scheduler.mjs` realising the `inProcess` scheduler with a fake-clock seam, and `src/job-run-log.mjs` realising the T-4-owned event sink (whitelist `event, jobId, jobName, attempts, duration, timestamp` plus optional `terminalErrorCode`). Two wired induced-failure switches (`SIMULATE_HANDLER_THROW`, `SIMULATE_PII_IN_JOB_INPUT`) drive the retry-and-fail and event-secrecy probe negative-run paths.
+- Declares `capabilities: ["backgroundJobs"]`, `suggestedCompanions: [{role: "logging"}, {role: "errorHandling"}]`, `providesRoles` absent, `requiresAppliedCapabilities: { capabilities: ["queue"], allowSkipFlag: "allow-no-queue-yet", refusalMessageId: "jobs-background-no-queue" }`. The T-3 `messaging-queue-cloudflare` v1.0.0 is the shipped provider of the `queue` capability.
+- Contributes ADR-3101 as `scope: global` on new topic `backgroundJobModel`. Future stateful-workflow siblings (Temporal-shape, Airflow-shape) will conflict here by design; the reserved round-6 Workflows adapter (per Baz section 5.7) lives INSIDE this blueprint as a v1.1.0 minor scheduler-mode value at ADR-3102, not as a sibling.
+- Every ADR contribution entry on `blueprint.json` carries a `standardsTraceClause` per section 8a.2 (mandatory per HQ mid-flight ruling after PR #154 gate).
+- Extends `packages/rcf-lite/docs/blueprint-authoring.md` section 6a capability-declaration table with one row for `backgroundJobs` naming the reserved stateful-workflow sibling posture per spec section 5.6.
+- Extends `packages/rcf-lite/src/cli/blueprint.js` OPTION_SPEC with `--allow-no-queue-yet` boolean flag piped into `allowNoAuthYet` alongside `--allow-no-auth-yet` and `--allow-no-secrets-yet`, and `packages/rcf-lite/src/blueprint/apply.js` `buildOverrideNote` family derivation to detect `queue` from the flag name so the sidecar notes read "no queue yet: applied under --allow-no-queue-yet" instead of "no auth yet".
+- Extends `packages/rcf-lite/test/blueprint/capabilities-apply.test.js` with four cases covering the queue-capability path end to end: bare-project refusal with tag and provider-name assertions, `--allow-no-queue-yet` override with queue-family sidecar-note assertion, happy path with `messaging-queue-cloudflare` applied producing `appliedCapabilities` including `queue`, and backward-compatible `--allow-no-auth-yet` also unblocks the override.
+- Reserved v1.1.0 minor: adds `scheduler: "workflows"` mode under ADR-3102 wrapping the same job-definition contract with Cloudflare Workflows `step.do` orchestration per section 5.7 of the spec and the fetched Workflows documentation.