rcf-lite 0.22.0 → 0.24.0

package/rcf/requirements/req-090.json

@@ -0,0 +1,44 @@
+{
+  "createdAt": "2026-09-07T19:54:00.724Z",
+  "updatedAt": "2026-09-07T20:18:17.227Z",
+  "description": "The applying project reaches Cloudflare Turnstile through a client widget mount that renders on elicited surfaces using the elicited TURNSTILE_SITEKEY. The mount injects only Cloudflare Turnstile JS (challenges.cloudflare.com/turnstile/v0/api.js) and no other third-party script. On submit the widget populates a hidden Cf-Turnstile-Response token field in the form payload. Chain: HQ round-6 T-5 reserved-block per HQ chain-block ruling 2026-09-07 (REQ-090..099 / US-90xx..94xx / TS-120..129 / FBS-110..119 / CN-350..379).",
+  "reqId": "REQ-090",
+  "prdId": "PRD-001",
+  "title": "T-5 edge-cloudflare-turnstile v1.0.0 blueprint: the Turnstile client widget mounts with an elicited sitekey and injects no third-party script beyond Cloudflare Turnstile JS host",
+  "category": "functional",
+  "domain": "functional",
+  "priority": "must",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [
+      "webUi",
+      "httpApi",
+      "auth"
+    ],
+    "reason": "keyword-scan",
+    "classifiedAt": "2026-09-07T19:54:00.763Z",
+    "signals": [
+      {
+        "source": "description",
+        "shape": "webUi",
+        "match": "renders"
+      },
+      {
+        "source": "description",
+        "shape": "httpApi",
+        "match": "api"
+      },
+      {
+        "source": "description",
+        "shape": "auth",
+        "match": "token"
+      },
+      {
+        "source": "description",
+        "shape": "webUi",
+        "match": "form"
+      }
+    ]
+  }
+}

package/rcf/requirements/req-091.json

@@ -0,0 +1,53 @@
+{
+  "createdAt": "2026-09-07T19:54:00.947Z",
+  "updatedAt": "2026-09-07T20:18:17.412Z",
+  "description": "The applying project verifies every Turnstile response token server-side by POSTing {secret: TURNSTILE_SECRET, response: <token>} to https://challenges.cloudflare.com/turnstile/v0/siteverify per Cloudflare Turnstile documented endpoint. On success:true the handler proceeds; on success:false the handler rejects with 400 and the refusal body carries the error-codes[] value, not the sitekey or secret.",
+  "reqId": "REQ-091",
+  "prdId": "PRD-001",
+  "title": "T-5 edge-cloudflare-turnstile v1.0.0: server-side siteverify POSTs the response token to challenges.cloudflare.com/turnstile/v0/siteverify with the elicited secret",
+  "category": "functional",
+  "domain": "functional",
+  "priority": "must",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [
+      "httpApi",
+      "auth"
+    ],
+    "reason": "keyword-scan",
+    "classifiedAt": "2026-09-07T19:54:00.984Z",
+    "signals": [
+      {
+        "source": "title",
+        "shape": "httpApi",
+        "match": "POST"
+      },
+      {
+        "source": "title",
+        "shape": "auth",
+        "match": "token"
+      },
+      {
+        "source": "description",
+        "shape": "auth",
+        "match": "token"
+      },
+      {
+        "source": "description",
+        "shape": "httpApi",
+        "match": "POST"
+      },
+      {
+        "source": "description",
+        "shape": "auth",
+        "match": "token"
+      },
+      {
+        "source": "description",
+        "shape": "httpApi",
+        "match": "endpoint"
+      }
+    ]
+  }
+}

package/rcf/requirements/req-092.json

@@ -0,0 +1,32 @@
+{
+  "createdAt": "2026-09-07T19:54:01.170Z",
+  "updatedAt": "2026-09-07T20:18:17.597Z",
+  "description": "The applying project registers a token-required guard at every elicited surface. A submit whose payload lacks the Cf-Turnstile-Response field is rejected with 400 before any downstream handler runs. The refusal body carries a stable error-code, not the sitekey.",
+  "reqId": "REQ-092",
+  "prdId": "PRD-001",
+  "title": "T-5 edge-cloudflare-turnstile v1.0.0: refuse-if-token-missing guard on elicited surfaces rejects submit with 400 before any downstream logic",
+  "category": "functional",
+  "domain": "functional",
+  "priority": "must",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [
+      "auth"
+    ],
+    "reason": "keyword-scan",
+    "classifiedAt": "2026-09-07T19:54:01.209Z",
+    "signals": [
+      {
+        "source": "title",
+        "shape": "auth",
+        "match": "token"
+      },
+      {
+        "source": "description",
+        "shape": "auth",
+        "match": "token"
+      }
+    ]
+  }
+}

package/rcf/requirements/req-093.json

@@ -0,0 +1,52 @@
+{
+  "createdAt": "2026-09-07T19:54:01.402Z",
+  "updatedAt": "2026-09-07T20:18:17.783Z",
+  "description": "When both security-auth-magic-link and edge-cloudflare-turnstile are applied, the magic-link mint surface reads through the Turnstile guard: a mint submit without a valid Turnstile response is refused with 400 before the mint fires. Composition uses the TAC-3603 hook on the shipped magic-link mint surface.",
+  "reqId": "REQ-093",
+  "prdId": "PRD-001",
+  "title": "T-5 edge-cloudflare-turnstile v1.0.0: composition with security-auth-magic-link refuses magic-link mint without a valid Turnstile token",
+  "category": "functional",
+  "domain": "functional",
+  "priority": "must",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [
+      "auth"
+    ],
+    "reason": "keyword-scan",
+    "classifiedAt": "2026-09-07T19:54:01.439Z",
+    "signals": [
+      {
+        "source": "title",
+        "shape": "auth",
+        "match": "magic-link"
+      },
+      {
+        "source": "title",
+        "shape": "auth",
+        "match": "magic-link"
+      },
+      {
+        "source": "title",
+        "shape": "auth",
+        "match": "token"
+      },
+      {
+        "source": "description",
+        "shape": "auth",
+        "match": "magic-link"
+      },
+      {
+        "source": "description",
+        "shape": "auth",
+        "match": "magic-link"
+      },
+      {
+        "source": "description",
+        "shape": "auth",
+        "match": "magic-link"
+      }
+    ]
+  }
+}

package/rcf/requirements/req-094.json

@@ -0,0 +1,32 @@
+{
+  "createdAt": "2026-09-07T19:54:01.626Z",
+  "updatedAt": "2026-09-07T20:18:17.970Z",
+  "description": "The applying operator elicits one of Cloudflare Turnstile documented widget modes: managed (default; renders challenge only when Cloudflare deems it necessary), non-interactive (always renders a non-interactive challenge) or invisible (mounts an invisible widget). The default mode is managed per the shipped ADR.",
+  "reqId": "REQ-094",
+  "prdId": "PRD-001",
+  "title": "T-5 edge-cloudflare-turnstile v1.0.0: widget mode is an elicited enum (managed, non-interactive, invisible) per Cloudflare documented modes; recommendedDefault is managed",
+  "category": "functional",
+  "domain": "functional",
+  "priority": "must",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [
+      "webUi"
+    ],
+    "reason": "keyword-scan",
+    "classifiedAt": "2026-09-07T19:54:01.664Z",
+    "signals": [
+      {
+        "source": "description",
+        "shape": "webUi",
+        "match": "renders"
+      },
+      {
+        "source": "description",
+        "shape": "webUi",
+        "match": "renders"
+      }
+    ]
+  }
+}

package/rcf/requirements/req-100.json

@@ -0,0 +1,13 @@
+{
+  "createdAt": "2026-09-07T21:38:51.465Z",
+  "updatedAt": "2026-09-07T23:05:23.440Z",
+  "description": "The applying project holds its rate-limit rule set as a set of JSON documents under the elicited rate-limit-rules-dir (default cloudflare/rate-limits/), one file per rule per ADR-3703. Every manifest file declares the seven documented fields the Cloudflare WAF rate-limiting rules contract names per https://developers.cloudflare.com/waf/rate-limiting-rules/: id, expression, threshold, period, characteristics, action, duration. The zone id is elicited and stored via secretsManagement; no rule references a secret in plaintext. Chain: HQ round-6 T-6 reserved-block per HQ chain-block ruling 2026-09-07 (REQ-100..109 / TS-130..139 / FBS-120..129 / CN-380..409). Round-6 T-6 track of Cloudflare-round-6-spec-2026-09-06 section 5.6.",
+  "reqId": "REQ-100",
+  "prdId": "PRD-001",
+  "title": "T-6 edge-cloudflare-rate-limiting v1.0.0 blueprint: rate-limit rule manifest committed under cloudflare/rate-limits/, one JSON file per rule, matching the elicited rule shape without plaintext secrets",
+  "category": "functional",
+  "domain": "functional",
+  "priority": "must",
+  "version": "0.1.0",
+  "status": "draft"
+}

package/rcf/requirements/req-101.json

@@ -0,0 +1,13 @@
+{
+  "createdAt": "2026-09-07T21:38:51.792Z",
+  "updatedAt": "2026-09-07T23:05:23.637Z",
+  "description": "The blueprint ships no committed script that writes rules to the live Cloudflare zone. The applying project's operator applies each rule via a documented wrangler command flow or a Cloudflare dashboard flow per TAC-3702 and the guide. The elicited rate-limit-management-surface value records the flow the operator chose; the guide covers both. Chain: HQ round-6 T-6 reserved-block per HQ chain-block ruling 2026-09-07.",
+  "reqId": "REQ-101",
+  "prdId": "PRD-001",
+  "title": "T-6 edge-cloudflare-rate-limiting v1.0.0 blueprint: operator-facing management surface documented as a wrangler command flow or Cloudflare dashboard flow the operator applies from the manifest",
+  "category": "functional",
+  "domain": "functional",
+  "priority": "must",
+  "version": "0.1.0",
+  "status": "draft"
+}

package/rcf/requirements/req-102.json

@@ -0,0 +1,13 @@
+{
+  "createdAt": "2026-09-07T21:38:52.126Z",
+  "updatedAt": "2026-09-07T23:05:23.824Z",
+  "description": "Given a rule that permits N requests per period on a characteristic set, when a client sends the (N+1)th request within that period, Cloudflare refuses the request at the edge for the elicited duration. The refusal response is HTTP 429 with a Retry-After header consistent with the elicited duration and a Cf-Ray header identifying the CF edge per https://developers.cloudflare.com/waf/rate-limiting-rules/. The origin Worker never sees the refused requests. Chain: HQ round-6 T-6 reserved-block per HQ chain-block ruling 2026-09-07.",
+  "reqId": "REQ-102",
+  "prdId": "PRD-001",
+  "title": "T-6 edge-cloudflare-rate-limiting v1.0.0 blueprint: over-threshold behaviour returns 429 with Retry-After and Cf-Ray for the (N+1)th and subsequent requests within the elicited duration",
+  "category": "functional",
+  "domain": "functional",
+  "priority": "must",
+  "version": "0.1.0",
+  "status": "draft"
+}

package/rcf/requirements/req-103.json

@@ -0,0 +1,13 @@
+{
+  "createdAt": "2026-09-07T21:38:52.452Z",
+  "updatedAt": "2026-09-07T23:05:24.011Z",
+  "description": "The blueprint ships a scheduled drift-audit runner (TAC-3703) the applying project can wire behind the elicited rate-limit-drift-audit-cadence per ADR-3704. When enabled, the runner fetches the live rate-limiting rules on the elicited zone via the Cloudflare API, diffs against the local manifest, and constructs one drift-audit record per mismatched rule. Records write through the applied logger with the metadata-only shape {ruleId, clientIpHash, outcome, timestamp, diff}; no record carries a full IP, a request body or a user agent. Chain: HQ round-6 T-6 reserved-block per HQ chain-block ruling 2026-09-07.",
+  "reqId": "REQ-103",
+  "prdId": "PRD-001",
+  "title": "T-6 edge-cloudflare-rate-limiting v1.0.0 blueprint: drift-audit runner reads live zone rules via the Cloudflare API and diffs against the local manifest, constructing metadata-only records",
+  "category": "functional",
+  "domain": "functional",
+  "priority": "must",
+  "version": "0.1.0",
+  "status": "draft"
+}

package/rcf/requirements/req-104.json

@@ -0,0 +1,13 @@
+{
+  "createdAt": "2026-09-07T21:38:52.795Z",
+  "updatedAt": "2026-09-07T23:05:24.201Z",
+  "description": "When both edge-cloudflare-rate-limiting and security-auth-magic-link are applied on the same project, the zone-level rate rule sits at the CF edge and refuses the (N+1)th request for the elicited duration before it reaches the origin; the security-auth-magic-link per-email application rate limiter continues to run at the mint-surface. The two rules operate on different characteristic sets (IP-per-URL vs per-email per-minute) and are additive. ADR-3702 records the layering. Chain: HQ round-6 T-6 reserved-block per HQ chain-block ruling 2026-09-07.",
+  "reqId": "REQ-104",
+  "prdId": "PRD-001",
+  "title": "T-6 edge-cloudflare-rate-limiting v1.0.0 blueprint: composition with security-auth-magic-link layers the zone rule over the per-email application rule per ADR-3702",
+  "category": "functional",
+  "domain": "functional",
+  "priority": "must",
+  "version": "0.1.0",
+  "status": "draft"
+}

package/rcf/tacs/tac-2214-application-admin-console-access-gated-signin-surface.json

@@ -0,0 +1,15 @@
+{
+  "createdAt": "2026-09-07T16:53:45.406Z",
+  "updatedAt": "2026-09-07T17:03:10.394Z",
+  "tacId": "TAC-2214-application-admin-console-access-gated-signin-surface",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "purpose": "Access-gated sign-in surface for application-admin-console v1.1.0: no local form, principal-read from request.auth via [data-role=principal-read]; falls back to local-login when zeroTrustGate absent.",
+  "responsibilities": [
+    "Realise the shape named in the purpose statement.",
+    "Bind the anchored ACs on the shipped probes and the extended admin-console pack."
+  ],
+  "name": "Access-gated sign-in surface shape with principal-read-from-request contract"
+}

package/rcf/tacs/tac-3501-edge-cloudflare-access-jwt-validator.json

@@ -0,0 +1,15 @@
+{
+  "createdAt": "2026-09-07T16:53:43.928Z",
+  "updatedAt": "2026-09-07T17:03:09.639Z",
+  "tacId": "TAC-3501-edge-cloudflare-access-jwt-validator",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "purpose": "Access JWT validator module; sole reader of the Cf-Access-Jwt-Assertion header; JWKS fetch cached per kid; principal reduces to {email, sub, groups}.",
+  "responsibilities": [
+    "Realise the shape named in the purpose statement.",
+    "Bind the anchored ACs on the shipped probes and the extended admin-console pack."
+  ],
+  "name": "Access JWT validator with JWKS fetch and cache"
+}

package/rcf/tacs/tac-3502-edge-cloudflare-access-application-declaration.json

@@ -0,0 +1,15 @@
+{
+  "createdAt": "2026-09-07T16:53:44.112Z",
+  "updatedAt": "2026-09-07T17:03:09.831Z",
+  "tacId": "TAC-3502-edge-cloudflare-access-application-declaration",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "purpose": "Access application declaration surface: elicited hostname or self-hosted-app id plus JWT audience, JWKS URL, policy shape and optional break-glass service-auth pair; recorded on the applied-sidecar.",
+  "responsibilities": [
+    "Realise the shape named in the purpose statement.",
+    "Bind the anchored ACs on the shipped probes and the extended admin-console pack."
+  ],
+  "name": "Access application declaration surface"
+}

package/rcf/tacs/tac-3503-edge-cloudflare-access-policy-shape.json

@@ -0,0 +1,15 @@
+{
+  "createdAt": "2026-09-07T16:53:44.296Z",
+  "updatedAt": "2026-09-07T17:03:10.018Z",
+  "tacId": "TAC-3503-edge-cloudflare-access-policy-shape",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "purpose": "Access policy shape enum with four values: email-domain, service-token-only, service-token-plus-email-domain, group-membership; drives the guide walk-through and the API alternative.",
+  "responsibilities": [
+    "Realise the shape named in the purpose statement.",
+    "Bind the anchored ACs on the shipped probes and the extended admin-console pack."
+  ],
+  "name": "Access policy shape enum and its issuance flow"
+}

package/rcf/tacs/tac-3504-edge-cloudflare-access-audit-sink.json

@@ -0,0 +1,15 @@
+{
+  "createdAt": "2026-09-07T16:53:44.481Z",
+  "updatedAt": "2026-09-07T17:03:10.205Z",
+  "tacId": "TAC-3504-edge-cloudflare-access-audit-sink",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "purpose": "Access audit sink contract: metadata-only shape {email, outcome, timestamp, path}; frozen at the validator boundary; retention delegated to the applied logging companion.",
+  "responsibilities": [
+    "Realise the shape named in the purpose statement.",
+    "Bind the anchored ACs on the shipped probes and the extended admin-console pack."
+  ],
+  "name": "Access audit sink with metadata-only shape"
+}

package/rcf/tacs/tac-3601-edge-cloudflare-turnstile-widget-mount.json

@@ -0,0 +1,15 @@
+{
+  "createdAt": "2026-09-07T19:56:37.865Z",
+  "updatedAt": "2026-09-07T19:56:37.865Z",
+  "purpose": "Turnstile client widget mount module; injects only Cloudflare Turnstile JS (challenges.cloudflare.com); renders with the elicited TURNSTILE_SITEKEY; populates the hidden Cf-Turnstile-Response token field on submit.",
+  "responsibilities": [
+    "Realise the shape named in the purpose statement.",
+    "Bind the anchored ACs on the shipped probes and the Playwright pack."
+  ],
+  "tacId": "TAC-3601-edge-cloudflare-turnstile-widget-mount",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "draft",
+  "name": "Turnstile client widget mount with elicited sitekey and third-party script pin"
+}

package/rcf/tacs/tac-3602-edge-cloudflare-turnstile-server-verifier.json

@@ -0,0 +1,15 @@
+{
+  "createdAt": "2026-09-07T19:56:38.049Z",
+  "updatedAt": "2026-09-07T19:56:38.049Z",
+  "purpose": "Turnstile server-side siteverify verifier; POSTs {secret, response} to https://challenges.cloudflare.com/turnstile/v0/siteverify; on success:true proceeds, on success:false rejects 400 with error-codes body; token-required guard rejects missing-token submits with 400 before any downstream handler runs.",
+  "responsibilities": [
+    "Realise the shape named in the purpose statement.",
+    "Bind the anchored ACs on the shipped probes and the Playwright pack."
+  ],
+  "tacId": "TAC-3602-edge-cloudflare-turnstile-server-verifier",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "draft",
+  "name": "Turnstile server-side siteverify verifier and refuse-if-token-missing guard"
+}

package/rcf/tacs/tac-3603-edge-cloudflare-turnstile-magic-link-hook.json

@@ -0,0 +1,15 @@
+{
+  "createdAt": "2026-09-07T19:56:38.233Z",
+  "updatedAt": "2026-09-07T19:56:38.233Z",
+  "purpose": "Composition hook on the security-auth-magic-link mint surface: the magic-link mint route reads through the Turnstile guard before invoking the mint; a missing or failed Turnstile token refuses the mint with 400.",
+  "responsibilities": [
+    "Realise the shape named in the purpose statement.",
+    "Bind the anchored ACs on the shipped probes and the Playwright pack."
+  ],
+  "tacId": "TAC-3603-edge-cloudflare-turnstile-magic-link-hook",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "draft",
+  "name": "Composition hook into security-auth-magic-link mint surface"
+}

package/rcf/tacs/tac-3701-edge-cloudflare-rate-limiting-manifest-schema.json

@@ -0,0 +1,16 @@
+{
+  "createdAt": "2026-09-07T21:40:45.360Z",
+  "updatedAt": "2026-09-07T21:40:45.360Z",
+  "purpose": "T-6 repo-chain TAC mirror for the shipped blueprints/edge-cloudflare-rate-limiting/contributions/tacs/tac-3701-edge-cloudflare-rate-limiting-manifest-schema.json contribution. Defines the JSON Schema shape and the manifest directory layout for the local rate-limit rules manifest per https://developers.cloudflare.com/waf/rate-limiting-rules/. Anchors AC-10001-1, AC-10601-1, AC-10801-1 (and AC-36101-1, AC-36106-1, AC-36108-1 on the shipped blueprint).",
+  "internalStructure": "One JSON Schema file at blueprints/edge-cloudflare-rate-limiting/contributions/schemas/rate-limit-rule.schema.json (draft-07); one shipped example manifest directory in the cf-edge fixture with two files.",
+  "responsibilities": [
+    "Ship a draft-07 JSON Schema for the rate-limit rule manifest file (AC-10001-1, AC-10601-1).",
+    "Ship the layout the manifest-presence probe scans (AC-10001-1, AC-10801-1)."
+  ],
+  "tacId": "TAC-3701-edge-cloudflare-rate-limiting-manifest-schema",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "draft",
+  "name": "Rate-limit rule manifest schema and manifest layout"
+}

package/rcf/tacs/tac-3702-edge-cloudflare-rate-limiting-management-surface-doc.json

@@ -0,0 +1,15 @@
+{
+  "createdAt": "2026-09-07T21:40:45.647Z",
+  "updatedAt": "2026-09-07T21:40:45.647Z",
+  "purpose": "T-6 repo-chain TAC mirror for the shipped blueprints/edge-cloudflare-rate-limiting/contributions/tacs/tac-3702-edge-cloudflare-rate-limiting-management-surface-doc.json contribution. Defines the operator-facing management surface documentation shape: both a wrangler command flow and a Cloudflare dashboard flow for applying one rule from a manifest file to the elicited zone. Anchors AC-10101-1 and AC-10401-1.",
+  "internalStructure": "One guide file at blueprints/edge-cloudflare-rate-limiting/guide/edge-cloudflare-rate-limiting.md with three named sections: Manifest, Management surface (wrangler and dashboard subsections), Composition with security-auth-magic-link.",
+  "responsibilities": [
+    "Ship the guide with both wrangler and dashboard flows plus the composition example (AC-10101-1, AC-10401-1)."
+  ],
+  "tacId": "TAC-3702-edge-cloudflare-rate-limiting-management-surface-doc",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "draft",
+  "name": "Operator-facing management surface documentation (wrangler and dashboard flows)"
+}

package/rcf/tacs/tac-3703-edge-cloudflare-rate-limiting-drift-audit-runner.json

@@ -0,0 +1,16 @@
+{
+  "createdAt": "2026-09-07T21:40:45.943Z",
+  "updatedAt": "2026-09-07T21:40:45.943Z",
+  "purpose": "T-6 repo-chain TAC mirror for the shipped blueprints/edge-cloudflare-rate-limiting/contributions/tacs/tac-3703-edge-cloudflare-rate-limiting-drift-audit-runner.json contribution. Defines the drift-audit runner: factory shape createDriftAuditRunner({env, eventSink, fetch, clock, cadence, manifestLoader}) that fetches live rules via the Cloudflare API and diffs against the local manifest, constructing metadata-only drift records. Anchors AC-10301-1 and AC-10701-1.",
+  "internalStructure": "One runner module realised in the cf-edge fixture at packages/rcf-lite/test/fixtures/cf-edge/src/drift-audit-runner.mjs. The applying project copies the shape from the blueprint guide; the fixture module is the shape probes drive.",
+  "responsibilities": [
+    "Ship the drift-audit runner factory (AC-10301-1).",
+    "Emit metadata-only audit records via the injected sink, Object.frozen at the boundary (AC-10701-1)."
+  ],
+  "tacId": "TAC-3703-edge-cloudflare-rate-limiting-drift-audit-runner",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "draft",
+  "name": "Drift-audit runner: read live zone rules via the Cloudflare API and diff against the local manifest"
+}

package/rcf/test-suites/ts-052.json

@@ -3,18 +3,68 @@
   "updatedAt": "2026-09-05T01:30:00.000Z",
   "purpose": "Cover AC-2301-1..7 via unit tests over the shipped application-admin-console blueprint.json contribution shape (23 contributions in 6 REQ / 9 US / 4 TAC / 4 ADR groups), the requiresAppliedCapabilities and elicits[] declarations, the pack-loader accepting the shipped pack file with every check id cross-checked against blueprint AC ids, the pack appliesTo predicate discipline (references BOTH tacIds and route), the sample-app fixture serving the console shell with the ARIA APG grid permission matrix, the CAPS switch surface selector, the users directory, org switcher, audit-log table with correlation id, access-denied and request-access control, and the negative-run behaviour on the ?break=matrix-grid, ?break=denied and ?break=audit-fields switches.",
   "testLevel": "unit",
-  "acIds": ["AC-2301-1", "AC-2301-2", "AC-2301-3", "AC-2301-4", "AC-2301-5", "AC-2301-6", "AC-2301-7"],
+  "acIds": [
+    "AC-2301-1",
+    "AC-2301-2",
+    "AC-2301-3",
+    "AC-2301-4",
+    "AC-2301-5",
+    "AC-2301-6",
+    "AC-2301-7"
+  ],
   "id": "TS-052",
   "usId": "US-2301",
   "title": "application-admin-console v1.0.0 shelf shape, capability discovery, probe pack cross-check and sample-app fixture",
   "testCases": [
-    {"id": "TC-052-blueprint-json-shape", "acId": "AC-2301-1", "description": "blueprint.json declares 23 contributions with requiresAppliedCapabilities and elicits[]", "status": "pending", "testPointer": "test/blueprint/application-admin-console-anatomy.test.js::blueprint.json declares 23 contributions with requiresAppliedCapabilities and elicits[] (TC-052-blueprint-json-shape)"},
-    {"id": "TC-052-applies-clean-with-override", "acId": "AC-2301-2", "description": "Fresh init project applies admin-console --allow-no-auth-yet and writes sidecar with allowNoAuthYet true", "status": "pending", "testPointer": "test/blueprint/application-admin-console-anatomy.test.js::apply --allow-no-auth-yet on bare SPA writes sidecar with allowNoAuthYet:true and empty appliedCapabilities (TC-052-applies-clean-with-override)"},
-    {"id": "TC-052-refuses-bare-spa", "acId": "AC-2301-3", "description": "Fresh init project without auth refuses admin-console apply with exit 3 and spec 5.5.1 message", "status": "pending", "testPointer": "test/blueprint/application-admin-console-anatomy.test.js::apply refuses on bare SPA with spec 5.5.1 verbatim message and lists applied blueprints (TC-052-refuses-bare-spa)"},
-    {"id": "TC-052-capability-discovery", "acId": "AC-2301-4", "description": "Discovery reads applied capabilities from applied blueprints", "status": "pending", "testPointer": "test/blueprint/application-admin-console-anatomy.test.js::apply on magic-link project yields [principalDirectory] and on clerk+logging project yields [principalDirectory,roleModel,auditLog] (TC-052-capability-discovery)"},
-    {"id": "TC-052-pack-checks-cross-check", "acId": "AC-2301-5", "description": "Every pack check id matches contributed AC id and applies gates on capability", "status": "pending", "testPointer": "test/blueprint/application-admin-console-anatomy.test.js::every pack check id matches a contributed AC id and appliesTo predicate gates on the applied capability (TC-052-pack-checks-cross-check)"},
-    {"id": "TC-052-fixture-surfaces", "acId": "AC-2301-6", "description": "Sample-app fixture serves the console shell with grid matrix and required data attributes", "status": "pending", "testPointer": "test/blueprint/application-admin-console-anatomy.test.js::sample-app fixture serves console shell with ARIA APG grid permission matrix and required data attributes (TC-052-fixture-surfaces)"},
-    {"id": "TC-052-negative-runs", "acId": "AC-2301-7", "description": "Break switches surface the three defects on the DOM", "status": "pending", "testPointer": "test/blueprint/application-admin-console-anatomy.test.js::sample-app fixture break switches surface the three defects on the DOM (TC-052-negative-runs)"}
+    {
+      "id": "TC-052-blueprint-json-shape",
+      "acId": "AC-2301-1",
+      "description": "blueprint.json declares 23 contributions with requiresAppliedCapabilities and elicits[]",
+      "status": "pending",
+      "testPointer": "test/blueprint/application-admin-console-anatomy.test.js::blueprint.json declares 28 contributions with requiresAppliedCapabilities and elicits[] (TC-052-blueprint-json-shape)"
+    },
+    {
+      "id": "TC-052-applies-clean-with-override",
+      "acId": "AC-2301-2",
+      "description": "Fresh init project applies admin-console --allow-no-auth-yet and writes sidecar with allowNoAuthYet true",
+      "status": "pending",
+      "testPointer": "test/blueprint/application-admin-console-anatomy.test.js::apply --allow-no-auth-yet on bare SPA writes sidecar with allowNoAuthYet:true and empty appliedCapabilities (TC-052-applies-clean-with-override)"
+    },
+    {
+      "id": "TC-052-refuses-bare-spa",
+      "acId": "AC-2301-3",
+      "description": "Fresh init project without auth refuses admin-console apply with exit 3 and spec 5.5.1 message",
+      "status": "pending",
+      "testPointer": "test/blueprint/application-admin-console-anatomy.test.js::apply refuses on bare SPA with spec 5.5.1 verbatim message and lists applied blueprints (TC-052-refuses-bare-spa)"
+    },
+    {
+      "id": "TC-052-capability-discovery",
+      "acId": "AC-2301-4",
+      "description": "Discovery reads applied capabilities from applied blueprints",
+      "status": "pending",
+      "testPointer": "test/blueprint/application-admin-console-anatomy.test.js::apply on magic-link project yields [principalDirectory] and on clerk+logging project yields [principalDirectory,roleModel,auditLog] (TC-052-capability-discovery)"
+    },
+    {
+      "id": "TC-052-pack-checks-cross-check",
+      "acId": "AC-2301-5",
+      "description": "Every pack check id matches contributed AC id and applies gates on capability",
+      "status": "pending",
+      "testPointer": "test/blueprint/application-admin-console-anatomy.test.js::every pack check id matches a contributed AC id and appliesTo predicate gates on the applied capability (TC-052-pack-checks-cross-check)"
+    },
+    {
+      "id": "TC-052-fixture-surfaces",
+      "acId": "AC-2301-6",
+      "description": "Sample-app fixture serves the console shell with grid matrix and required data attributes",
+      "status": "pending",
+      "testPointer": "test/blueprint/application-admin-console-anatomy.test.js::sample-app fixture serves console shell with ARIA APG grid permission matrix and required data attributes (TC-052-fixture-surfaces)"
+    },
+    {
+      "id": "TC-052-negative-runs",
+      "acId": "AC-2301-7",
+      "description": "Break switches surface the three defects on the DOM",
+      "status": "pending",
+      "testPointer": "test/blueprint/application-admin-console-anatomy.test.js::sample-app fixture break switches surface the three defects on the DOM (TC-052-negative-runs)"
+    }
   ],
   "status": "draft"
 }

package/rcf/test-suites/ts-072.json

@@ -0,0 +1,62 @@
+{
+  "createdAt": "2026-09-06T19:17:48.415Z",
+  "updatedAt": "2026-09-06T19:18:05.472Z",
+  "purpose": "Cover AC-4201-1..6 via unit tests over the shipped messaging-queue-cloudflare blueprint shape (contribution count, capabilities, suggestedCompanions, ADR standardsTraceClause), applies-clean behaviour, REQ-004 dead_letter_queue grep and retention wording, six Node-only probe module contract with anchorAcId cross-check, induced-failure switch documentation on the fixture README, and shelf-doc consistency (section 6a table row for queue with reserved sibling note, shelf-wide docs/topics.md row for messaging-queue-cloudflare at 29101-29899 / 30xx).",
+  "testLevel": "unit",
+  "acIds": [
+    "AC-4201-1",
+    "AC-4201-2",
+    "AC-4201-3",
+    "AC-4201-4",
+    "AC-4201-5",
+    "AC-4201-6"
+  ],
+  "id": "TS-072",
+  "usId": "US-4201",
+  "title": "messaging-queue-cloudflare v1.0.0 shelf shape, apply-clean, DLQ REQ description grep, six-probe module contract, induced-failure switches and shelf-doc consistency",
+  "testCases": [
+    {
+      "id": "TC-072-blueprint-json-shape",
+      "acId": "AC-4201-1",
+      "description": "Cover AC-4201-1 via anatomy test",
+      "status": "pending",
+      "testPointer": "test/blueprint/messaging-queue-cloudflare-anatomy.test.js::blueprint.json declares 21 contributions with capabilities queue, suggestedCompanions logging and errorHandling, and standardsTraceClause on every ADR entry (TC-072-blueprint-json-shape)"
+    },
+    {
+      "id": "TC-072-applies-clean",
+      "acId": "AC-4201-2",
+      "description": "Cover AC-4201-2 via anatomy test",
+      "status": "pending",
+      "testPointer": "test/blueprint/messaging-queue-cloudflare-anatomy.test.js::apply messaging-queue-cloudflare lands 21 contributions on a scratch project (TC-072-applies-clean)"
+    },
+    {
+      "id": "TC-072-dlq-req-grep",
+      "acId": "AC-4201-3",
+      "description": "Cover AC-4201-3 via anatomy test",
+      "status": "pending",
+      "testPointer": "test/blueprint/messaging-queue-cloudflare-anatomy.test.js::REQ-004 description names dead_letter_queue and the 4-day DLQ retention with the Cloudflare DLQ doc URL (TC-072-dlq-req-grep)"
+    },
+    {
+      "id": "TC-072-probe-anchor-ids-cross-check",
+      "acId": "AC-4201-4",
+      "description": "Cover AC-4201-4 via anatomy test",
+      "status": "pending",
+      "testPointer": "test/blueprint/messaging-queue-cloudflare-anatomy.test.js::every probe module exports the section 3.2 verdict envelope with an anchorAcId matching a contributed AC id (TC-072-probe-anchor-ids-cross-check)"
+    },
+    {
+      "id": "TC-072-fixture-and-switches",
+      "acId": "AC-4201-5",
+      "description": "Cover AC-4201-5 via anatomy test",
+      "status": "pending",
+      "testPointer": "test/blueprint/messaging-queue-cloudflare-anatomy.test.js::sample-app fixture ships wrangler.toml, src/producer.mjs, src/consumer.mjs, src/dlq-inspector.mjs, and its README documents wrangler dev and the three wired induced-failure switches (TC-072-fixture-and-switches)"
+    },
+    {
+      "id": "TC-072-shelf-doc-consistency",
+      "acId": "AC-4201-6",
+      "description": "Cover AC-4201-6 via anatomy test",
+      "status": "pending",
+      "testPointer": "test/blueprint/messaging-queue-cloudflare-anatomy.test.js::section 6a table gains a queue row with reserved messaging-queue-postgres sibling and every shipped blueprint docs/topics.md gains a messaging-queue-cloudflare row at 29101-29899 / 30xx (TC-072-shelf-doc-consistency)"
+    }
+  ],
+  "status": "draft"
+}