rcf-lite 0.22.0 → 0.24.0

package/rcf/requirements/req-042.json

@@ -0,0 +1,59 @@
+{
+  "createdAt": "2026-09-06T19:16:55.365Z",
+  "updatedAt": "2026-09-06T19:16:55.402Z",
+  "category": "functional",
+  "domain": "application",
+  "priority": "must",
+  "description": "The rcf-lite shelf ships the messaging-queue-cloudflare v1.0.0 blueprint (blueprints/messaging-queue-cloudflare/) with 20 to 24 contributions per the ratified infra round 5 spec section 5.3: 6 REQs (producer facade sole-reader of the Queues binding with producerReady on boot; publish/consume/ack with stable message-id and producer-supplied trace-id; retry contract; DLQ contract with default max-attempts 3 and 4-day retention per Cloudflare Queues dead-letter documentation; batch consume bounded by Cloudflare max 100 messages and max 60 seconds per Cloudflare Queues platform limits; four lifecycle events with metadata-only fields), 8 USs 29101-29108 binding runtime-observable ACs, 3 TACs (3001 producer facade, 3002 consumer registration on the Worker queue handler, 3003 event sink), 4 ADRs (3001 adapter Cloudflare Queues shipped first adapter, 3002 deliverySemantics scope global at-least-once, 3003 max-attempts default 3 floor 1 ceiling 100, 3004 batch size default 10 batch timeout default 5 seconds). The blueprint declares suggestedCompanions logging and errorHandling with spec section 5.3 reasons, providesRoles absent, capabilities [queue], requiresAppliedCapabilities absent (composes on deploy-cloudflare-workers transitively via the wrangler binding, not through the capability mechanism). Contributes ADR-3002 as scope:global on new topic deliverySemantics with at-least-once as the shipped shape so future exactly-once or at-most-once siblings conflict here by design. Ships six probe modules under blueprints/messaging-queue-cloudflare/contributions/probes/ each exporting the spec section 3.2 verdict envelope with an anchorAcId matching a contributed AC id, and matching run-shims writing per-blueprint reports at .rcf/reports/blueprints/messaging-queue-cloudflare/. Four probes local-first (accountBound false); real-account-concurrency-smoke carries accountBound true and records the accountBoundSkipped shape per spec section 3.5 without CI_HAS_CLOUDFLARE_ACCOUNT. Ships the T-3 side of the shared sample-app fixture at packages/rcf-lite/test/fixtures/infra-s3-and-queue/ with a wrangler.toml declaring a Cloudflare Worker with queue binding RCF_TEST_QUEUE and DLQ binding RCF_TEST_DLQ, an in-memory queue driver enabling Node-only probes without live Cloudflare Queues, producer and consumer modules realising the facade contract, three wired induced-failure switches (SIMULATE_CONSUMER_RETRY, SIMULATE_DLQ_OVERFLOW, SIMULATE_PII_IN_BODY), and a README extension naming the wrangler dev boot line and the elicited parameters. Extends packages/rcf-lite/docs/blueprint-authoring.md section 6a capability-declaration table with one row for queue naming the reserved messaging-queue-postgres sibling per Baz decision 7 and spec section 5.6. Appends one row for messaging-queue-cloudflare at US band 29101-29899 / ADR-TAC suffix block 30xx to the shelf-wide id-band registry table under docs/topics.md on every shipped blueprint. Minted with dex reserved-block chain ids via --id per HQ mid-flight ruling on repo-chain id blocks per train. Miniflare Queues sub-page is NOT cited (spec confirmed 404); the Cloudflare Queues local-development page is the citation for the wrangler dev seam.",
+  "reqId": "REQ-042",
+  "prdId": "PRD-001",
+  "title": "Messaging-queue-cloudflare v1.0.0 blueprint on the shelf",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [
+      "webUi",
+      "httpApi",
+      "persistence"
+    ],
+    "reason": "keyword-scan",
+    "classifiedAt": "2026-09-06T19:16:55.400Z",
+    "signals": [
+      {
+        "source": "description",
+        "shape": "webUi",
+        "match": "table"
+      },
+      {
+        "source": "description",
+        "shape": "persistence",
+        "match": "table"
+      },
+      {
+        "source": "description",
+        "shape": "httpApi",
+        "match": "post"
+      },
+      {
+        "source": "description",
+        "shape": "webUi",
+        "match": "table"
+      },
+      {
+        "source": "description",
+        "shape": "persistence",
+        "match": "table"
+      },
+      {
+        "source": "description",
+        "shape": "webUi",
+        "match": "page"
+      },
+      {
+        "source": "description",
+        "shape": "webUi",
+        "match": "page"
+      }
+    ]
+  }
+}

package/rcf/requirements/req-043.json

@@ -0,0 +1,39 @@
+{
+  "createdAt": "2026-09-06T20:28:34.000Z",
+  "updatedAt": "2026-09-07T10:18:08.299Z",
+  "category": "functional",
+  "domain": "application",
+  "priority": "must",
+  "description": "The rcf-lite shelf ships the jobs-background v1.0.0 blueprint (blueprints/jobs-background/) with 22 contributions per the ratified infra round 5 spec section 5.4: 6 REQs (requires an applied queue capability via the T-5 mechanism and refuses apply on a bare project with exit 3 plus stable message id jobs-background-no-queue; job-definition contract carrying name, handler, input schema opaque per project, retry policy, timeout; scheduler contract carrying POSIX cron string and one-shot delayed; retry contract inheriting the applied queue's max-attempts ceiling; job-run event log at four moments jobScheduled jobStarted jobCompleted jobFailed with metadata-only fields; operator-facing surface elicited between cli httpEndpoint none), 9 USs 30101-30109 binding runtime-observable ACs (one US per REQ plus three cross-cutting cases apply-time refusal on bare scheduled fire on cron and retry-then-DLQ), 3 TACs (3101 job-definition module 3102 scheduler 3103 run log), 4 ADRs (3101 scope:global on new topic backgroundJobModel retry-and-schedule as the shipped shape; 3102 scheduler mode elicited between inProcess workerCron and external with a reserved v1.1.0 workflows slot per spec section 5.7 and round-6 proposal decision b; 3103 requires capabilities:[queue] with allowSkipFlag allow-no-queue-yet and refusalMessageId jobs-background-no-queue; 3104 default handler timeout 60 seconds floor 1 second ceiling bounded by the applied queue's consumer wall-clock which for Cloudflare Queues is 15 minutes per limits doc). The blueprint declares suggestedCompanions logging and errorHandling with spec section 5.4 reasons, providesRoles absent, capabilities [backgroundJobs], requiresAppliedCapabilities {capabilities:[queue],allowSkipFlag:allow-no-queue-yet,refusalMessageId:jobs-background-no-queue} per Baz decision 5 verbatim. Contributes ADR-3101 as scope:global on new topic backgroundJobModel with retry-and-schedule as the shipped shape so future stateful-workflow siblings (Temporal-shape Airflow-shape) conflict here by design; the round-6 Workflows minor bump inside jobs-background itself does NOT mint a sibling per spec section 5.6 (it lives inside the same blueprint as an elicited scheduler mode value at ADR-3102). Ships five probe modules under blueprints/jobs-background/contributions/probes/ each exporting the spec section 3.2 verdict envelope with an anchorAcId matching a contributed AC id and matching run-shims writing per-blueprint reports at .rcf/reports/blueprints/jobs-background/: apply-time-refusal.mjs (bare project rcf define blueprint add refuses exit 3 with tag jobs-background-no-queue on stderr and names messaging-queue-cloudflare explicitly per Q3 default asserting both exit code and message id), apply-time-override.mjs (same bare project with --allow-no-queue-yet exits 0 and sidecar rcf/blueprints/jobs-background.applied.json records a note naming the missing capability and the override flag; the spec section 5.4 prose reference to manifest.blueprints[jobs-background].source.notes is superseded by the shipped T-5 mechanism which writes the note on the sidecar because the applied-blueprint-record schema is closed), fake-clock-cron.mjs (with messaging-queue-cloudflare and jobs-background both applied on the shared sample-app fixture drives the in-memory queue seam from T-3 through one fake-clock cron minute and asserts jobStarted fires within the elicited fire-tolerance window plus jobCompleted within the elicited timeout), retry-and-fail.mjs (schedules a job with a handler throwing under SIMULATE_HANDLER_THROW drives through maxAttempts re-deliveries and asserts jobStarted fires 3 times with matching job-id and incrementing attempt counter plus jobFailed fires with terminal code), event-secrecy.mjs (schedules a job with PII fixture input drives to completion and asserts every event record carries only {jobId,jobName,attempts,duration,timestamp} whitelist and NO input fields NO output fields NO user id NO SSN NO email). All five probes accountBound false. Extends the shared sample-app fixture at packages/rcf-lite/test/fixtures/infra-s3-and-queue/ (T-2/T-3 have already landed the fixture directory) with a jobs/ directory carrying two toy job-definition modules (send-welcome-email.mjs with retry policy {maxAttempts:3,backoff:exponential} timeout 60 seconds and refresh-cache.mjs with retry policy {maxAttempts:5,backoff:constant} timeout 10 seconds cron every-minute), src/jobs-runtime.mjs realising the runtime that reads applied queue capability from the sidecar registers job handlers with the queue consumer dispatches per message fires the four lifecycle events per REQ-005 and respects the elicited timeout and retry policy per job definition, src/scheduler.mjs realising the inProcess scheduler with a fake-clock seam the fake-clock-cron probe drives, package.json start:jobs script, and README extension naming the two toy jobs the jobs/ directory convention the fake-clock switch the elicited parameters the induced-failure switches SIMULATE_HANDLER_THROW and SIMULATE_PII_IN_JOB_INPUT and the gate-reviewer two-line boot. Extends packages/rcf-lite/src/cli/blueprint.js OPTION_SPEC with allow-no-queue-yet boolean flag piped into allowNoAuthYet, and packages/rcf-lite/src/blueprint/apply.js buildOverrideNote family derivation to detect queue from the flag name (so sidecar notes read no queue yet: applied under --allow-no-queue-yet). Extends packages/rcf-lite/test/blueprint/capabilities-apply.test.js with four cases covering jobs-background bare refusal (tag and messaging-queue-cloudflare name assertions), --allow-no-queue-yet override (sidecar notes queue-family assertion), happy path with messaging-queue-cloudflare applied (appliedCapabilities includes queue), and legacy allow-no-auth-yet also unblocks the override (backward-compatible OR piping). Extends packages/rcf-lite/docs/blueprint-authoring.md section 6a capability-declaration table with one row for backgroundJobs naming the reserved sibling posture per spec section 5.6. Appends one row for jobs-background at US band 30101-30899 / ADR-TAC suffix block 31xx to the shelf-wide id-band registry table under docs/topics.md on every shipped blueprint. Minted with dex reserved-block chain ids via --id per HQ mid-flight ruling on repo-chain id blocks per train (REQ-043 / US-4301 / TS-076 / FBS-064 / CN-214..217 (originally TS-073 / FBS-063 / CN-209..212, re-minted at next-free after HQ round-6 T-0 PR #164 landed on origin/main 321371e and consumed the original block; REQ-043 and US-4301 did not collide and are unchanged) continuing the block after T-3 landed at 042/4201/072/062/206..208). Wrangler is not on this build host so probes run against the in-memory queue-driver seam T-3 landed on the fixture (SDR-3-a coordinator ruling accepted the in-memory realisation of the Cloudflare Queues binding shape); the live wrangler-dev cron-trigger path is enumerated as a per-AC mechanism-reach gap in the README per round-3 checklist 6.g form.",
+  "reqId": "REQ-043",
+  "prdId": "PRD-001",
+  "title": "Jobs-background v1.0.0 blueprint on the shelf",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [
+      "webUi",
+      "httpApi",
+      "persistence"
+    ],
+    "reason": "keyword-scan",
+    "classifiedAt": "2026-09-06T20:28:34.000Z",
+    "signals": [
+      {
+        "source": "description",
+        "shape": "webUi",
+        "match": "table"
+      },
+      {
+        "source": "description",
+        "shape": "persistence",
+        "match": "table"
+      },
+      {
+        "source": "description",
+        "shape": "httpApi",
+        "match": "endpoint"
+      }
+    ]
+  }
+}

package/rcf/requirements/req-050.json

@@ -0,0 +1,18 @@
+{
+  "createdAt": "2026-09-07T10:18:25.168Z",
+  "updatedAt": "2026-09-07T10:20:10.276Z",
+  "reqId": "REQ-050",
+  "prdId": "PRD-001",
+  "title": "T-1 platform-cloudflare-kv v1.0.0 blueprint: the KV facade module is the sole reader of the KV binding and opens on boot with facadeReady",
+  "description": "T-1 platform-cloudflare-kv v1.0.0: one KV facade module in the applied project source tree is the SOLE reader of the Cloudflare Workers KV binding (env.CACHE in the fixture; the elicited binding name in a real project). Every other module that touches KV imports the facade and calls its typed domain verbs (get, getWithMetadata, put, delete, list); no other module dereferences the raw KV binding. On process boot, the facade opens against the bound namespace with a bounded list(limit:1) ready-check and emits a facadeReady lifecycle event on the injected event sink. Chain: HQ round-6 T-1 reserved-block, id block REQ-050..054 / US-5001..5401 / TS-080..087 / FBS-070 / CN-230..234 per HQ chain-block ruling 2026-09-07T10:12Z.",
+  "category": "functional",
+  "domain": "platform",
+  "priority": "must",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [],
+    "reason": "content-pending",
+    "classifiedAt": "2026-09-07T10:18:25.198Z"
+  }
+}

package/rcf/requirements/req-051.json

@@ -0,0 +1,18 @@
+{
+  "createdAt": "2026-09-07T10:18:25.373Z",
+  "updatedAt": "2026-09-07T10:20:10.276Z",
+  "reqId": "REQ-051",
+  "prdId": "PRD-001",
+  "title": "T-1 typed put get delete list verbs with metadata field pattern realise the Workers KV binding shape behind the facade",
+  "description": "T-1 typed put get delete list realise the Workers KV binding shape behind the facade. put(key, value, {ttl, metadata}) writes with expirationTtl and metadata to the binding; get(key) returns null on miss; getWithMetadata(key) returns {value, metadata}; delete(key) is idempotent; list({prefix, limit, cursor}) paginates keys with metadata shape intact per the Cloudflare KV binding contract at https://developers.cloudflare.com/kv/api/. Metadata is a JSON-serialisable object; the shipped default metadata field pattern is {v: number} (elicited).",
+  "category": "functional",
+  "domain": "platform",
+  "priority": "must",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [],
+    "reason": "content-pending",
+    "classifiedAt": "2026-09-07T10:18:25.402Z"
+  }
+}

package/rcf/requirements/req-052.json

@@ -0,0 +1,18 @@
+{
+  "createdAt": "2026-09-07T10:18:25.579Z",
+  "updatedAt": "2026-09-07T10:20:10.276Z",
+  "reqId": "REQ-052",
+  "prdId": "PRD-001",
+  "title": "T-1 cache-aside helper reads local first falls back to origin and writes back with elicited TTL floor 1 second",
+  "description": "T-1 cache-aside helper wraps a domain-origin call with the facade. getOr(key, originFn, {ttl}) reads local first via facade.get; on hit returns the cached value with source cache; on miss invokes originFn, writes back through facade.put with the effective TTL (elicited default 60 seconds per ADR-3202; floor 1 second enforced at this seam; no upper ceiling per Cloudflare KV documented per-namespace limits at https://developers.cloudflare.com/kv/platform/limits/), and returns the fresh value with source origin.",
+  "category": "functional",
+  "domain": "platform",
+  "priority": "must",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [],
+    "reason": "content-pending",
+    "classifiedAt": "2026-09-07T10:18:25.608Z"
+  }
+}

package/rcf/requirements/req-053.json

@@ -0,0 +1,18 @@
+{
+  "createdAt": "2026-09-07T10:18:25.784Z",
+  "updatedAt": "2026-09-07T10:20:10.276Z",
+  "reqId": "REQ-053",
+  "prdId": "PRD-001",
+  "title": "T-1 lifecycle events facadeReady kvHit kvMiss kvWrite carry metadata-only fields key size ttl timestamp",
+  "description": "T-1 lifecycle events. The facade emits facadeReady on the injected sink once the ready-check returns; kvHit on a get that resolves to a non-null value; kvMiss on a get that resolves to null; kvWrite on put and delete. Every event record carries EXACTLY the fields {event, key, size, ttl, timestamp}: no body bytes, no metadata bag pass-through, no user id beyond the key itself. The event-secrecy probe drives this at REQ-053 mechanism reach.",
+  "category": "functional",
+  "domain": "platform",
+  "priority": "must",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [],
+    "reason": "content-pending",
+    "classifiedAt": "2026-09-07T10:18:25.813Z"
+  }
+}

package/rcf/requirements/req-054.json

@@ -0,0 +1,18 @@
+{
+  "createdAt": "2026-09-07T10:18:25.999Z",
+  "updatedAt": "2026-09-07T10:20:10.276Z",
+  "reqId": "REQ-054",
+  "prdId": "PRD-001",
+  "title": "T-1 eventual-consistency note in the guide: a write may not appear on a global read within the same request and the elicited TTL sets the staleness ceiling",
+  "description": "T-1 eventual-consistency note: Workers KV is eventually consistent per the Cloudflare KV consistency documentation at https://developers.cloudflare.com/kv/concepts/how-kv-works/. A write may not appear on a global read within the same request; the elicited cache-aside TTL (default 60 seconds per Cloudflare-documented cache TTL default) sets the staleness ceiling readers observe. The guide surfaces the note and the decision-tree cross-reference to platform-cloudflare-durable-objects for strong-consistency needs (round-6 T-3 owns the DO adapter).",
+  "category": "functional",
+  "domain": "platform",
+  "priority": "must",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [],
+    "reason": "content-pending",
+    "classifiedAt": "2026-09-07T10:18:26.039Z"
+  }
+}

package/rcf/requirements/req-060.json

@@ -0,0 +1,20 @@
+{
+  "createdAt": "2026-09-07T12:26:47.779Z",
+  "updatedAt": "2026-09-07T12:26:47.813Z",
+  "description": "T-2 platform-cloudflare-cron-triggers v1.0.0: one scheduled() handler in the applied project source tree is the SOLE reader of the Cloudflare Workers Cron Trigger event (the event handler shape documented at https://developers.cloudflare.com/workers/configuration/cron-triggers/). The handler binds on boot, wires the dispatcher (REQ-061) and the event sink (per TAC-3303), and emits a cronReady lifecycle event on the injected sink with a metadata-only payload. Chain: HQ round-6 T-2 reserved-block per HQ chain-block ruling 2026-09-07T12:25Z.",
+  "category": "functional",
+  "domain": "platform",
+  "priority": "must",
+  "reqId": "REQ-060",
+  "prdId": "PRD-001",
+  "title": "T-2 platform-cloudflare-cron-triggers v1.0.0 blueprint: the scheduled() handler is the sole reader of the Cron Trigger event and opens on boot with cronReady",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [
+      "none"
+    ],
+    "reason": "keyword-scan",
+    "classifiedAt": "2026-09-07T12:26:47.812Z"
+  }
+}

package/rcf/requirements/req-061.json

@@ -0,0 +1,18 @@
+{
+  "createdAt": "2026-09-07T12:26:47.991Z",
+  "updatedAt": "2026-09-07T12:28:41.280Z",
+  "description": "T-2 platform-cloudflare-cron-triggers v1.0.0: the dispatcher module accepts an ordered map of cron-expression to handler pairs and, on every scheduled() invocation, matches the incoming Cron Trigger event's cron expression against the map and routes exactly to the matched handler. An unmatched expression records an unmatchedExpression event on the sink and the scheduled invocation returns without side effect. The routed handler receives a bounded context {expression, scheduledTime, sink} so its own emissions can be attributed. Chain: HQ round-6 T-2 reserved-block per HQ chain-block ruling 2026-09-07T12:25Z.",
+  "category": "functional",
+  "domain": "platform",
+  "priority": "must",
+  "reqId": "REQ-061",
+  "prdId": "PRD-001",
+  "title": "T-2 expression-router: multiple cron expressions route to distinct handlers by expression match",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [],
+    "reason": "content-pending",
+    "classifiedAt": "2026-09-07T12:29:00.000Z"
+  }
+}

package/rcf/requirements/req-062.json

@@ -0,0 +1,20 @@
+{
+  "createdAt": "2026-09-07T12:26:48.199Z",
+  "updatedAt": "2026-09-07T12:26:48.232Z",
+  "description": "T-2 platform-cloudflare-cron-triggers v1.0.0: an elicited skew-tolerance window (default 30 seconds per ADR-3303; floor 5s, ceiling 5 minutes) governs how the dispatcher classifies a fire. If the observed handler start time is within the window of the event's scheduledTime, the fire's outcome is onTime and a cronFired event carries {expression, scheduledTime, outcome: onTime, duration}. If the observed start is outside the window, a cronSkewed event fires with the delta (observed minus scheduled, in milliseconds) and the outcome is skewed; the handler still runs. Chain: HQ round-6 T-2 reserved-block per HQ chain-block ruling 2026-09-07T12:25Z.",
+  "category": "functional",
+  "domain": "platform",
+  "priority": "must",
+  "reqId": "REQ-062",
+  "prdId": "PRD-001",
+  "title": "T-2 skew tolerance: a fire inside the elicited window is onTime; outside it records cronSkewed with the delta",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [
+      "none"
+    ],
+    "reason": "keyword-scan",
+    "classifiedAt": "2026-09-07T12:26:48.230Z"
+  }
+}

package/rcf/requirements/req-063.json

@@ -0,0 +1,20 @@
+{
+  "createdAt": "2026-09-07T12:26:48.409Z",
+  "updatedAt": "2026-09-07T12:26:48.442Z",
+  "description": "T-2 platform-cloudflare-cron-triggers v1.0.0: an elicited soft-budget duration (default 30 seconds per elicited answer, no floor) governs when a running handler is flagged as stalled. The dispatcher never terminates a handler on soft-budget breach (Cloudflare's platform concern is the sole terminator); it fires a cronStalled event with metadata-only payload {expression, scheduledTime, outcome: stalled, duration, softBudgetMs} at the moment the observed duration crosses the budget and lets the handler continue. Every scheduled-side event record on the sink carries only {expression, scheduledTime, outcome, duration} plus the event tag; handler input closures, PII fields and body bytes never cross the sink boundary. Chain: HQ round-6 T-2 reserved-block per HQ chain-block ruling 2026-09-07T12:25Z.",
+  "category": "functional",
+  "domain": "platform",
+  "priority": "must",
+  "reqId": "REQ-063",
+  "prdId": "PRD-001",
+  "title": "T-2 soft budget and event secrecy: a handler running past the elicited budget logs cronStalled but does not terminate; every event record is metadata-only",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [
+      "none"
+    ],
+    "reason": "keyword-scan",
+    "classifiedAt": "2026-09-07T12:26:48.441Z"
+  }
+}

package/rcf/requirements/req-070.json

@@ -0,0 +1,18 @@
+{
+  "createdAt": "2026-09-07T14:11:36.742Z",
+  "updatedAt": "2026-09-07T14:13:26.508Z",
+  "reqId": "REQ-070",
+  "prdId": "PRD-001",
+  "title": "T-3 platform-cloudflare-durable-objects v1.0.0 blueprint: the DO facade is the sole reader of env.CELL and env.HUB and opens on boot with namespaceReady",
+  "description": "T-3 platform-cloudflare-durable-objects v1.0.0: one DO facade module in the applied project source tree is the SOLE reader of env.CELL and env.HUB (per https://developers.cloudflare.com/durable-objects/). On process boot, the facade wires the injected event sink and emits a namespaceReady lifecycle event with a metadata-only payload; the facade exposes typed handles per named object (cellHandle(name), hubHandle(name)) and never exposes the raw binding to consumers. Chain: HQ round-6 T-3 reserved-block per HQ chain-block ruling 2026-09-07 (REQ-070..079 / US-70xx..79xx / TS-100..109 / FBS-090..099 / CN-290..319).",
+  "category": "functional",
+  "domain": "platform",
+  "priority": "must",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [],
+    "reason": "content-pending",
+    "classifiedAt": "2026-09-07T14:11:36.775Z"
+  }
+}

package/rcf/requirements/req-071.json

@@ -0,0 +1,18 @@
+{
+  "createdAt": "2026-09-07T14:11:36.953Z",
+  "updatedAt": "2026-09-07T14:13:26.508Z",
+  "reqId": "REQ-071",
+  "prdId": "PRD-001",
+  "title": "T-3 single-cell shape exposes typed domain verbs and serialises concurrent invocations per instance",
+  "description": "T-3 single-cell shape: a named SingleCellObject exposes typed domain verbs (increment, read, reset) that wrap the injected storage driver. Cloudflare's documented DO consistency model serialises invocations against the same instance; the shipped class realises that contract via a per-instance FIFO promise queue so a concurrent-increment probe observes the counter sum and one increment observed the other via a written witness (per REQ-071 and AC-33102-1, AC-33109-1).",
+  "category": "functional",
+  "domain": "platform",
+  "priority": "must",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [],
+    "reason": "content-pending",
+    "classifiedAt": "2026-09-07T14:11:36.986Z"
+  }
+}

package/rcf/requirements/req-072.json

@@ -0,0 +1,18 @@
+{
+  "createdAt": "2026-09-07T14:11:37.164Z",
+  "updatedAt": "2026-09-07T14:13:26.508Z",
+  "reqId": "REQ-072",
+  "prdId": "PRD-001",
+  "title": "T-3 storage API provides typed put/get/delete on the object with an elicited backend (SQL or KV)",
+  "description": "T-3 storage API: the object's state.storage surface exposes typed put(key,value), get(key), delete(key) and list({prefix}) verbs. Storage backend is elicited (sql or kv per ADR-3403); the shipped storage driver factory is backend-agnostic and threads through the elicited answer as driver.backend. A storage-round-trip probe drives both backends via a fixture switch (AC-33103-1, AC-33111-1).",
+  "category": "functional",
+  "domain": "platform",
+  "priority": "must",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [],
+    "reason": "content-pending",
+    "classifiedAt": "2026-09-07T14:11:37.197Z"
+  }
+}

package/rcf/requirements/req-073.json

@@ -0,0 +1,18 @@
+{
+  "createdAt": "2026-09-07T14:11:37.377Z",
+  "updatedAt": "2026-09-07T14:13:26.508Z",
+  "reqId": "REQ-073",
+  "prdId": "PRD-001",
+  "title": "T-3 alarm surface fires alarm() exactly once per scheduled time and doAlarmFired carries objectName and scheduledTime",
+  "description": "T-3 alarm surface: a named object supports storage.setAlarm(scheduledTime) and an alarm() handler. The shipped alarm handler drains the persisted alarm from storage on each fire so a second alarm() call on the drained storage does not re-fire for the same schedule; the injected event sink records a doAlarmFired event with {objectName, scheduledTime} metadata fields on each fire (AC-33104-1, AC-33106-1).",
+  "category": "functional",
+  "domain": "platform",
+  "priority": "must",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [],
+    "reason": "content-pending",
+    "classifiedAt": "2026-09-07T14:11:37.412Z"
+  }
+}

package/rcf/requirements/req-074.json

@@ -0,0 +1,18 @@
+{
+  "createdAt": "2026-09-07T14:11:37.592Z",
+  "updatedAt": "2026-09-07T14:13:26.508Z",
+  "reqId": "REQ-074",
+  "prdId": "PRD-001",
+  "title": "T-3 hibernatable WebSocket hub accepts clients via state.acceptWebSocket and the wake handler runs from cold reading the same storage",
+  "description": "T-3 hibernatable WebSocket hub: a named HubObject accepts websocket clients via state.acceptWebSocket, routes each webSocketMessage by JSON type field, and broadcasts to all connected sockets. Storage persists the last broadcast so a re-emerging client can catch up; on hibernate-and-wake the wake handler runs from a cold start, reads the same storage, and emits doWakeUp exactly once (idempotent-by-contract per ADR-3405) (AC-33105-1, AC-33110-1).",
+  "category": "functional",
+  "domain": "platform",
+  "priority": "must",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [],
+    "reason": "content-pending",
+    "classifiedAt": "2026-09-07T14:11:37.625Z"
+  }
+}

package/rcf/requirements/req-075.json

@@ -0,0 +1,18 @@
+{
+  "createdAt": "2026-09-07T14:11:37.805Z",
+  "updatedAt": "2026-09-07T14:13:26.508Z",
+  "reqId": "REQ-075",
+  "prdId": "PRD-001",
+  "title": "T-3 lifecycle events fire at namespace and object level with metadata-only payloads",
+  "description": "T-3 lifecycle events: the facade and both DO classes emit metadata-only records on the injected event sink: namespaceReady (facade), doAccept, doAlarmFired, doWakeUp, doHibernate (object). Every record carries only allowed keys drawn from {event, key, size, ttl, timestamp, objectName, scheduledTime}; no message payloads, request bodies or PII cross the sink. The event-secrecy result on the websocket-hub-broadcast probe (AC-33106-1) covers the metadata-only contract on the shipped path.",
+  "category": "functional",
+  "domain": "platform",
+  "priority": "must",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [],
+    "reason": "content-pending",
+    "classifiedAt": "2026-09-07T14:11:37.838Z"
+  }
+}

package/rcf/requirements/req-076.json

@@ -0,0 +1,18 @@
+{
+  "createdAt": "2026-09-07T14:11:38.018Z",
+  "updatedAt": "2026-09-07T14:13:26.508Z",
+  "reqId": "REQ-076",
+  "prdId": "PRD-001",
+  "title": "T-3 sole-reader guarantee enforced by AST scan: no non-facade module imports env.CELL or env.HUB",
+  "description": "T-3 sole-reader guarantee: the shipped sole-reader-scan probe reads every .mjs/.js/.ts file under the fixture's applied source root, strips block and line comments, and matches literal occurrences of env.CELL and env.HUB against the file path. The clean-fixture pass asserts src/do-facade.mjs is the ONLY file whose live source matches; any other file with a live match is a leak returned as fail (AC-33107-1).",
+  "category": "functional",
+  "domain": "platform",
+  "priority": "must",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [],
+    "reason": "content-pending",
+    "classifiedAt": "2026-09-07T14:11:38.051Z"
+  }
+}

package/rcf/requirements/req-077.json

@@ -0,0 +1,18 @@
+{
+  "createdAt": "2026-09-07T14:11:38.243Z",
+  "updatedAt": "2026-09-07T14:13:26.508Z",
+  "reqId": "REQ-077",
+  "prdId": "PRD-001",
+  "title": "T-3 migration-safe class exports: stable class names committed to wrangler with a paired [[migrations]] block",
+  "description": "T-3 migration-safe class exports: the DO class names are stable strings committed under [[durable_objects.bindings]] blocks in wrangler.toml, and a paired [[migrations]] block records the mint classes under tag \"v1\" per Cloudflare's migration documentation. A rename ships as a subsequent migrations tag; a rename without one is a runtime error the anatomy assertion catches at self-review (AC-33108-1).",
+  "category": "functional",
+  "domain": "platform",
+  "priority": "must",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [],
+    "reason": "content-pending",
+    "classifiedAt": "2026-09-07T14:11:38.275Z"
+  }
+}

package/rcf/requirements/req-080.json

@@ -0,0 +1,18 @@
+{
+  "createdAt": "2026-09-07T16:49:01.509Z",
+  "updatedAt": "2026-09-07T17:14:19.059Z",
+  "reqId": "REQ-080",
+  "prdId": "PRD-001",
+  "title": "T-4 edge-cloudflare-access v1.0.0 blueprint: the Access JWT validator is the sole reader of the Cf-Access-Jwt-Assertion header and reduces principal onto request.auth",
+  "description": "The applying Workers project reaches Cloudflare Access through a single JWT validator module (src/jwt-validator.mjs) that is the ONLY module dereferencing the Cf-Access-Jwt-Assertion header. The validator fetches the JWKS from the elicited endpoint, caches keys per-kid, verifies the JWT and reduces the principal into request.auth as {email, sub, groups}. Chain: HQ round-6 T-4 reserved-block per HQ chain-block ruling 2026-09-07 (REQ-080..089 / US-80xx..89xx / TS-110..119 / FBS-100..109 / CN-320..349).",
+  "category": "functional",
+  "domain": "functional",
+  "priority": "must",
+  "version": "1.0.0",
+  "status": "approved",
+  "shapeClassification": {
+    "shapes": [],
+    "reason": "content-pending",
+    "classifiedAt": "2026-09-07T16:49:01.543Z"
+  }
+}

package/rcf/requirements/req-081.json

@@ -0,0 +1,18 @@
+{
+  "createdAt": "2026-09-07T16:49:11.871Z",
+  "updatedAt": "2026-09-07T17:14:19.252Z",
+  "reqId": "REQ-081",
+  "prdId": "PRD-001",
+  "title": "T-4 edge-cloudflare-access v1.0.0: an Access application is declared with an elicited hostname or self-hosted-app id and an elicited policy shape from the enum",
+  "description": "The blueprint elicits either an Access application hostname or a self-hosted-app id, plus the JWT audience, JWKS URL and a policy shape from the enum. Applying the blueprint records the values on rcf/blueprints/edge-cloudflare-access.applied.json.",
+  "category": "functional",
+  "domain": "functional",
+  "priority": "must",
+  "version": "1.0.0",
+  "status": "approved",
+  "shapeClassification": {
+    "shapes": [],
+    "reason": "content-pending",
+    "classifiedAt": "2026-09-07T16:49:11.906Z"
+  }
+}

package/rcf/requirements/req-082.json

@@ -0,0 +1,18 @@
+{
+  "createdAt": "2026-09-07T16:49:12.089Z",
+  "updatedAt": "2026-09-07T17:14:19.438Z",
+  "reqId": "REQ-082",
+  "prdId": "PRD-001",
+  "title": "T-4 edge-cloudflare-access v1.0.0: the operator issues a Zero Trust policy via the dashboard or the API path documented in the guide",
+  "description": "The shipped guide documents two paths for issuing the Zero Trust policy: a dashboard walk-through screen-by-screen and a curl example against api.cloudflare.com/client/v4/accounts/{account_id}/access/apps/{app_id}/policies per https://developers.cloudflare.com/cloudflare-one/policies/access/.",
+  "category": "functional",
+  "domain": "functional",
+  "priority": "must",
+  "version": "1.0.0",
+  "status": "approved",
+  "shapeClassification": {
+    "shapes": [],
+    "reason": "content-pending",
+    "classifiedAt": "2026-09-07T16:49:12.123Z"
+  }
+}

package/rcf/requirements/req-083.json

@@ -0,0 +1,18 @@
+{
+  "createdAt": "2026-09-07T16:49:12.304Z",
+  "updatedAt": "2026-09-07T17:14:19.647Z",
+  "reqId": "REQ-083",
+  "prdId": "PRD-001",
+  "title": "T-4 edge-cloudflare-access v1.0.0: the audit event carries metadata-only fields email, outcome, timestamp and path with no token value or headers",
+  "description": "Every validate outcome emits one audit event on the injected sink with the metadata-only shape {email, outcome, timestamp, path}. The record is Object.frozen at the boundary; no downstream module can enrich it with a stray token slice.",
+  "category": "functional",
+  "domain": "functional",
+  "priority": "must",
+  "version": "1.0.0",
+  "status": "approved",
+  "shapeClassification": {
+    "shapes": [],
+    "reason": "content-pending",
+    "classifiedAt": "2026-09-07T16:49:12.339Z"
+  }
+}

package/rcf/requirements/req-084.json

@@ -0,0 +1,18 @@
+{
+  "createdAt": "2026-09-07T16:49:12.520Z",
+  "updatedAt": "2026-09-07T17:14:19.838Z",
+  "reqId": "REQ-084",
+  "prdId": "PRD-001",
+  "title": "T-4 edge-cloudflare-access v1.0.0: break-glass posture with an elicited bypass-service-auth token pair for CI-signed automation",
+  "description": "The operator elicits a break-glass service-auth id; the paired secret is delegated to the applied secretsManagement companion. Requests presenting the paired CF-Access-Client-Id and CF-Access-Client-Secret headers authenticate with outcome=bypass.",
+  "category": "functional",
+  "domain": "functional",
+  "priority": "must",
+  "version": "1.0.0",
+  "status": "approved",
+  "shapeClassification": {
+    "shapes": [],
+    "reason": "content-pending",
+    "classifiedAt": "2026-09-07T16:49:12.555Z"
+  }
+}

package/rcf/requirements/req-085.json

@@ -0,0 +1,18 @@
+{
+  "createdAt": "2026-09-07T16:49:12.737Z",
+  "updatedAt": "2026-09-07T17:14:20.026Z",
+  "reqId": "REQ-085",
+  "prdId": "PRD-001",
+  "title": "T-4 edge-cloudflare-access v1.0.0: the composition with application-admin-console flips the sign-in surface when the applied capability set contains zeroTrustGate",
+  "description": "When application-admin-console v1.1.0 is applied alongside edge-cloudflare-access, the admin-console reads appliedCapabilities via readAppliedCapabilities() at apply-time and flips its sign-in surface between Access-gated and local-login.",
+  "category": "functional",
+  "domain": "functional",
+  "priority": "must",
+  "version": "1.0.0",
+  "status": "approved",
+  "shapeClassification": {
+    "shapes": [],
+    "reason": "content-pending",
+    "classifiedAt": "2026-09-07T16:49:12.772Z"
+  }
+}

package/rcf/requirements/req-086.json

@@ -0,0 +1,18 @@
+{
+  "createdAt": "2026-09-07T16:49:12.954Z",
+  "updatedAt": "2026-09-07T17:14:20.211Z",
+  "reqId": "REQ-086",
+  "prdId": "PRD-001",
+  "title": "T-4 application-admin-console v1.1.0 minor: consume zeroTrustGate optionally, replacing the local sign-in form with an Access-gated surface when the capability is applied",
+  "description": "application-admin-console v1.1.0 additive minor: consumes zeroTrustGate optionally, replacing the local sign-in form with an Access-gated surface when the capability is applied. Q4 default: consumption is OPTIONAL; principalDirectory remains the sole hard requirement (making Access-gate hard is a v2.0 change).",
+  "category": "functional",
+  "domain": "functional",
+  "priority": "must",
+  "version": "1.0.0",
+  "status": "approved",
+  "shapeClassification": {
+    "shapes": [],
+    "reason": "content-pending",
+    "classifiedAt": "2026-09-07T16:49:12.990Z"
+  }
+}