rcf-lite 0.22.0 → 0.24.0

package/rcf/test-suites/ts-102.json

@@ -0,0 +1,22 @@
+{
+  "createdAt": "2026-09-07T14:13:43.579Z",
+  "updatedAt": "2026-09-07T14:14:37.070Z",
+  "purpose": "Cover AC-7201-1 via anatomy test: storage round-trip on both sql and kv backends",
+  "testLevel": "unit",
+  "acIds": [
+    "AC-7201-1"
+  ],
+  "id": "TS-102",
+  "usId": "US-7201",
+  "title": "T-3 storage round-trip",
+  "testCases": [
+    {
+      "id": "TC-102-storage-round-trip",
+      "acId": "AC-7201-1",
+      "description": "AC-7201-1 anatomy proof",
+      "status": "pending",
+      "testPointer": "test/blueprint/platform-cloudflare-durable-objects-anatomy.test.js::storage round-trip covers put get delete list on both sql and kv backends (TC-102-storage-round-trip)"
+    }
+  ],
+  "status": "draft"
+}

package/rcf/test-suites/ts-103.json

@@ -0,0 +1,22 @@
+{
+  "createdAt": "2026-09-07T14:13:43.758Z",
+  "updatedAt": "2026-09-07T14:14:37.070Z",
+  "purpose": "Cover AC-7301-1 via anatomy test: alarm fires once and drains storage",
+  "testLevel": "unit",
+  "acIds": [
+    "AC-7301-1"
+  ],
+  "id": "TS-103",
+  "usId": "US-7301",
+  "title": "T-3 alarm fires once",
+  "testCases": [
+    {
+      "id": "TC-103-alarm-fires-once",
+      "acId": "AC-7301-1",
+      "description": "AC-7301-1 anatomy proof",
+      "status": "pending",
+      "testPointer": "test/blueprint/platform-cloudflare-durable-objects-anatomy.test.js::alarm fires exactly once and drains storage (TC-103-alarm-fires-once)"
+    }
+  ],
+  "status": "draft"
+}

package/rcf/test-suites/ts-104.json

@@ -0,0 +1,22 @@
+{
+  "createdAt": "2026-09-07T14:13:43.939Z",
+  "updatedAt": "2026-09-07T14:14:37.070Z",
+  "purpose": "Cover AC-7401-1 via anatomy test: hub broadcast fans out within window",
+  "testLevel": "unit",
+  "acIds": [
+    "AC-7401-1"
+  ],
+  "id": "TS-104",
+  "usId": "US-7401",
+  "title": "T-3 hub broadcast within window",
+  "testCases": [
+    {
+      "id": "TC-104-hub-broadcast",
+      "acId": "AC-7401-1",
+      "description": "AC-7401-1 anatomy proof",
+      "status": "pending",
+      "testPointer": "test/blueprint/platform-cloudflare-durable-objects-anatomy.test.js::hub broadcast fans out to all connected clients within the elicited window (TC-104-hub-broadcast)"
+    }
+  ],
+  "status": "draft"
+}

package/rcf/test-suites/ts-105.json

@@ -0,0 +1,22 @@
+{
+  "createdAt": "2026-09-07T14:13:44.119Z",
+  "updatedAt": "2026-09-07T14:14:37.070Z",
+  "purpose": "Cover AC-7402-1 via anatomy test: hibernate-and-wake round-trip preserves storage",
+  "testLevel": "unit",
+  "acIds": [
+    "AC-7402-1"
+  ],
+  "id": "TS-105",
+  "usId": "US-7402",
+  "title": "T-3 hibernate-and-wake preserves storage",
+  "testCases": [
+    {
+      "id": "TC-105-hibernate-wake",
+      "acId": "AC-7402-1",
+      "description": "AC-7402-1 anatomy proof",
+      "status": "pending",
+      "testPointer": "test/blueprint/platform-cloudflare-durable-objects-anatomy.test.js::hibernate and wake round trip preserves storage and doWakeUp fires exactly once (TC-105-hibernate-wake)"
+    }
+  ],
+  "status": "draft"
+}

package/rcf/test-suites/ts-106.json

@@ -0,0 +1,22 @@
+{
+  "createdAt": "2026-09-07T14:13:44.299Z",
+  "updatedAt": "2026-09-07T14:14:37.070Z",
+  "purpose": "Cover AC-7501-1 via anatomy test: event-secrecy on shipped path returns pass with zero forbidden keys",
+  "testLevel": "unit",
+  "acIds": [
+    "AC-7501-1"
+  ],
+  "id": "TS-106",
+  "usId": "US-7501",
+  "title": "T-3 event-secrecy shipped path",
+  "testCases": [
+    {
+      "id": "TC-106-event-secrecy",
+      "acId": "AC-7501-1",
+      "description": "AC-7501-1 anatomy proof",
+      "status": "pending",
+      "testPointer": "test/blueprint/platform-cloudflare-durable-objects-anatomy.test.js::event-secrecy result on the hub broadcast probe returns pass on the shipped path (TC-106-event-secrecy)"
+    }
+  ],
+  "status": "draft"
+}

package/rcf/test-suites/ts-107.json

@@ -0,0 +1,22 @@
+{
+  "createdAt": "2026-09-07T14:13:44.480Z",
+  "updatedAt": "2026-09-07T14:14:37.070Z",
+  "purpose": "Cover AC-7601-1 via anatomy test: sole-reader-scan probe module exports the anchor and shape",
+  "testLevel": "unit",
+  "acIds": [
+    "AC-7601-1"
+  ],
+  "id": "TS-107",
+  "usId": "US-7601",
+  "title": "T-3 sole-reader-scan probe shape",
+  "testCases": [
+    {
+      "id": "TC-107-sole-reader-scan",
+      "acId": "AC-7601-1",
+      "description": "AC-7601-1 anatomy proof",
+      "status": "pending",
+      "testPointer": "test/blueprint/platform-cloudflare-durable-objects-anatomy.test.js::sole-reader-scan probe binds and surfaces no leaks on the clean fixture (TC-107-sole-reader-scan)"
+    }
+  ],
+  "status": "draft"
+}

package/rcf/test-suites/ts-108.json

@@ -0,0 +1,22 @@
+{
+  "createdAt": "2026-09-07T14:13:44.660Z",
+  "updatedAt": "2026-09-07T14:14:37.070Z",
+  "purpose": "Cover AC-7701-1 via anatomy test: wrangler.toml carries DO bindings and migrations tag",
+  "testLevel": "unit",
+  "acIds": [
+    "AC-7701-1"
+  ],
+  "id": "TS-108",
+  "usId": "US-7701",
+  "title": "T-3 wrangler.toml DO bindings and migrations",
+  "testCases": [
+    {
+      "id": "TC-108-wrangler-do-bindings",
+      "acId": "AC-7701-1",
+      "description": "AC-7701-1 anatomy proof",
+      "status": "pending",
+      "testPointer": "test/blueprint/platform-cloudflare-durable-objects-anatomy.test.js::wrangler toml carries DO bindings and migrations tag additively over T-0 T-1 T-2 blocks (TC-108-wrangler-do-bindings)"
+    }
+  ],
+  "status": "draft"
+}

package/rcf/test-suites/ts-109.json

@@ -0,0 +1,22 @@
+{
+  "createdAt": "2026-09-07T14:13:44.840Z",
+  "updatedAt": "2026-09-07T14:14:37.071Z",
+  "purpose": "Cover AC-7002-1 via anatomy test: real-account probe records accountBoundSkipped without env var",
+  "testLevel": "unit",
+  "acIds": [
+    "AC-7002-1"
+  ],
+  "id": "TS-109",
+  "usId": "US-7002",
+  "title": "T-3 real-account probe skipped without env var",
+  "testCases": [
+    {
+      "id": "TC-109-real-account-skip",
+      "acId": "AC-7002-1",
+      "description": "AC-7002-1 anatomy proof",
+      "status": "pending",
+      "testPointer": "test/blueprint/platform-cloudflare-durable-objects-anatomy.test.js::real-account storage smoke probe records accountBoundSkipped without env var (TC-109-real-account-skip)"
+    }
+  ],
+  "status": "draft"
+}

package/rcf/test-suites/ts-110.json

@@ -0,0 +1,22 @@
+{
+  "createdAt": "2026-09-07T16:52:18.024Z",
+  "updatedAt": "2026-09-07T16:53:10.788Z",
+  "purpose": "Cover AC-8001-1 via anatomy test: fixture JWT validates, principal reduces to {email,sub,groups} on request.auth",
+  "testLevel": "unit",
+  "acIds": [
+    "AC-8001-1"
+  ],
+  "id": "TS-110",
+  "usId": "US-8001",
+  "title": "T-4 JWT validator: fixture-signed JWT validates and principal reduces onto request.auth",
+  "testCases": [
+    {
+      "id": "TC-110-jwt-validator-pass",
+      "acId": "AC-8001-1",
+      "description": "AC-8001-1 anatomy proof",
+      "status": "pending",
+      "testPointer": "test/blueprint/edge-cloudflare-access-anatomy.test.js::JWT validator validates a fixture-signed JWT and reduces principal onto request auth (TC-110-jwt-validator-pass)"
+    }
+  ],
+  "status": "draft"
+}

package/rcf/test-suites/ts-111.json

@@ -0,0 +1,22 @@
+{
+  "createdAt": "2026-09-07T16:52:18.228Z",
+  "updatedAt": "2026-09-07T16:53:10.972Z",
+  "purpose": "Cover AC-8002-1 via anatomy test: missing, expired, mis-signed each 401 with allowed audit keys only",
+  "testLevel": "unit",
+  "acIds": [
+    "AC-8002-1"
+  ],
+  "id": "TS-111",
+  "usId": "US-8002",
+  "title": "T-4 JWT validator: reject cases return 401 with metadata-only audit event",
+  "testCases": [
+    {
+      "id": "TC-111-jwt-validator-reject",
+      "acId": "AC-8002-1",
+      "description": "AC-8002-1 anatomy proof",
+      "status": "pending",
+      "testPointer": "test/blueprint/edge-cloudflare-access-anatomy.test.js::JWT validator rejects missing expired and mis-signed with metadata-only audit event (TC-111-jwt-validator-reject)"
+    }
+  ],
+  "status": "draft"
+}

package/rcf/test-suites/ts-112.json

@@ -0,0 +1,22 @@
+{
+  "createdAt": "2026-09-07T16:52:18.413Z",
+  "updatedAt": "2026-09-07T16:53:11.156Z",
+  "purpose": "Cover AC-8003-1 via anatomy test: fixture applied source tree grepped, only validator hits the header string in live source",
+  "testLevel": "unit",
+  "acIds": [
+    "AC-8003-1"
+  ],
+  "id": "TS-112",
+  "usId": "US-8003",
+  "title": "T-4 sole-reader guarantee: src/jwt-validator.mjs is the only reader of the Cf-Access-Jwt-Assertion header",
+  "testCases": [
+    {
+      "id": "TC-112-sole-reader-boundary",
+      "acId": "AC-8003-1",
+      "description": "AC-8003-1 anatomy proof",
+      "status": "pending",
+      "testPointer": "test/blueprint/edge-cloudflare-access-anatomy.test.js::jwt-validator mjs is the sole reader of the Cf-Access-Jwt-Assertion header in the fixture source tree (TC-112-sole-reader-boundary)"
+    }
+  ],
+  "status": "draft"
+}

package/rcf/test-suites/ts-113.json

@@ -0,0 +1,22 @@
+{
+  "createdAt": "2026-09-07T16:52:18.597Z",
+  "updatedAt": "2026-09-07T16:53:11.340Z",
+  "purpose": "Cover AC-8101-1 via anatomy test: blueprint.json elicits block carries the expected ids and default values",
+  "testLevel": "unit",
+  "acIds": [
+    "AC-8101-1"
+  ],
+  "id": "TS-113",
+  "usId": "US-8101",
+  "title": "T-4 Access application declaration: elicits access-application-host/id and access-policy-shape",
+  "testCases": [
+    {
+      "id": "TC-113-elicits-application-declaration",
+      "acId": "AC-8101-1",
+      "description": "AC-8101-1 anatomy proof",
+      "status": "pending",
+      "testPointer": "test/blueprint/edge-cloudflare-access-anatomy.test.js::blueprint json elicits Access application host or self-hosted id plus policy shape enum (TC-113-elicits-application-declaration)"
+    }
+  ],
+  "status": "draft"
+}

package/rcf/test-suites/ts-114.json

@@ -0,0 +1,22 @@
+{
+  "createdAt": "2026-09-07T16:52:18.782Z",
+  "updatedAt": "2026-09-07T16:53:11.523Z",
+  "purpose": "Cover AC-8201-1 via anatomy test: guide file greps for both section headings, curl example, and vendor URL",
+  "testLevel": "unit",
+  "acIds": [
+    "AC-8201-1"
+  ],
+  "id": "TS-114",
+  "usId": "US-8201",
+  "title": "T-4 policy issuance guide: dashboard walk-through and API alternative documented",
+  "testCases": [
+    {
+      "id": "TC-114-guide-policy-issuance",
+      "acId": "AC-8201-1",
+      "description": "AC-8201-1 anatomy proof",
+      "status": "pending",
+      "testPointer": "test/blueprint/edge-cloudflare-access-anatomy.test.js::guide carries dashboard walk-through and API alternative with vendor URL (TC-114-guide-policy-issuance)"
+    }
+  ],
+  "status": "draft"
+}

package/rcf/test-suites/ts-115.json

@@ -0,0 +1,22 @@
+{
+  "createdAt": "2026-09-07T16:52:18.965Z",
+  "updatedAt": "2026-09-07T16:53:11.708Z",
+  "purpose": "Cover AC-8301-1 via anatomy test: driver runs the validator 10 times and asserts sink shape",
+  "testLevel": "unit",
+  "acIds": [
+    "AC-8301-1"
+  ],
+  "id": "TS-115",
+  "usId": "US-8301",
+  "title": "T-4 audit metadata secrecy: 10 records after 5+5 runs, no forbidden substrings",
+  "testCases": [
+    {
+      "id": "TC-115-audit-metadata-secrecy",
+      "acId": "AC-8301-1",
+      "description": "AC-8301-1 anatomy proof",
+      "status": "pending",
+      "testPointer": "test/blueprint/edge-cloudflare-access-anatomy.test.js::audit sink after 5 pass 5 reject holds 10 metadata-only records with no forbidden substrings (TC-115-audit-metadata-secrecy)"
+    }
+  ],
+  "status": "draft"
+}

package/rcf/test-suites/ts-116.json

@@ -0,0 +1,22 @@
+{
+  "createdAt": "2026-09-07T16:52:19.149Z",
+  "updatedAt": "2026-09-07T16:53:11.893Z",
+  "purpose": "Cover AC-8401-1 via anatomy test: paired headers observed, principal service:<id>, audit outcome=bypass with allowed keys",
+  "testLevel": "unit",
+  "acIds": [
+    "AC-8401-1"
+  ],
+  "id": "TS-116",
+  "usId": "US-8401",
+  "title": "T-4 break-glass posture: bypass-service-auth pair authenticates and audits as outcome=bypass",
+  "testCases": [
+    {
+      "id": "TC-116-break-glass-bypass",
+      "acId": "AC-8401-1",
+      "description": "AC-8401-1 anatomy proof",
+      "status": "pending",
+      "testPointer": "test/blueprint/edge-cloudflare-access-anatomy.test.js::break-glass bypass-service-auth pair authenticates and audits outcome bypass with allowed keys (TC-116-break-glass-bypass)"
+    }
+  ],
+  "status": "draft"
+}

package/rcf/test-suites/ts-117.json

@@ -0,0 +1,22 @@
+{
+  "createdAt": "2026-09-07T16:52:19.333Z",
+  "updatedAt": "2026-09-07T16:53:12.077Z",
+  "purpose": "Cover AC-8501-1 via anatomy test: extended admin-console fixture DOM inspection on both caps combinations",
+  "testLevel": "unit",
+  "acIds": [
+    "AC-8501-1"
+  ],
+  "id": "TS-117",
+  "usId": "US-8501",
+  "title": "T-4 admin-console composition: sign-in surface flips per applied capability set",
+  "testCases": [
+    {
+      "id": "TC-117-admin-console-gate-surface",
+      "acId": "AC-8501-1",
+      "description": "AC-8501-1 anatomy proof",
+      "status": "pending",
+      "testPointer": "test/blueprint/edge-cloudflare-access-anatomy.test.js::extended admin-console pack fixture flips sign-in surface per applied capability set (TC-117-admin-console-gate-surface)"
+    }
+  ],
+  "status": "draft"
+}

package/rcf/test-suites/ts-118.json

@@ -0,0 +1,22 @@
+{
+  "createdAt": "2026-09-07T16:52:19.533Z",
+  "updatedAt": "2026-09-07T16:53:12.260Z",
+  "purpose": "Cover AC-8601-1 via anatomy test: gated caps combination renders access-gated surface and no local-login",
+  "testLevel": "unit",
+  "acIds": [
+    "AC-8601-1"
+  ],
+  "id": "TS-118",
+  "usId": "US-8601",
+  "title": "T-4 admin-console v1.1.0 Access-gated surface: pack check AC-21815-1 fires on gated fixture",
+  "testCases": [
+    {
+      "id": "TC-118-admin-console-gated-pack-check",
+      "acId": "AC-8601-1",
+      "description": "AC-8601-1 anatomy proof",
+      "status": "pending",
+      "testPointer": "test/blueprint/edge-cloudflare-access-anatomy.test.js::admin-console v1_1_0 pack check AC-21815-1 fires on gated caps combination (TC-118-admin-console-gated-pack-check)"
+    }
+  ],
+  "status": "draft"
+}

package/rcf/test-suites/ts-119.json

@@ -0,0 +1,30 @@
+{
+  "createdAt": "2026-09-07T16:52:19.718Z",
+  "updatedAt": "2026-09-07T16:53:12.816Z",
+  "purpose": "Cover AC-8602-1 via anatomy test: non-gated caps combination renders local-login and no access-gated",
+  "testLevel": "unit",
+  "acIds": [
+    "AC-8602-1",
+    "AC-8502-1"
+  ],
+  "id": "TS-119",
+  "usId": "US-8602",
+  "title": "T-4 admin-console v1.1.0 fallback: local-login surface renders without zeroTrustGate",
+  "testCases": [
+    {
+      "id": "TC-119-admin-console-fallback",
+      "acId": "AC-8602-1",
+      "description": "AC-8602-1 anatomy proof",
+      "status": "pending",
+      "testPointer": "test/blueprint/edge-cloudflare-access-anatomy.test.js::admin-console v1_1_0 renders local-login surface on the non-gated caps combination (TC-119-admin-console-fallback)"
+    },
+    {
+      "id": "TC-119-real-account-gated-url-skipped",
+      "acId": "AC-8502-1",
+      "description": "AC-8502-1 anatomy proof under real-account probe module and shim (accountBoundSkipped path in unit)",
+      "status": "pending",
+      "testPointer": "test/blueprint/edge-cloudflare-access-anatomy.test.js::real-account-gated-url probe records accountBoundSkipped when env vars absent (TC-119-real-account-gated-url-skipped)"
+    }
+  ],
+  "status": "draft"
+}

package/rcf/test-suites/ts-120.json

@@ -0,0 +1,22 @@
+{
+  "createdAt": "2026-09-07T19:56:40.460Z",
+  "updatedAt": "2026-09-07T19:56:40.645Z",
+  "purpose": "Cover AC-9001-1 via anatomy test: pack fixture renders Turnstile widget with always-pass sitekey; iframe origin Cloudflare only; no third-party script; hidden Cf-Turnstile-Response token populates on submit",
+  "testLevel": "integration",
+  "acIds": [
+    "AC-9001-1"
+  ],
+  "id": "TS-120",
+  "usId": "US-9001",
+  "title": "T-5 AC-9001-1 anatomy proof",
+  "testCases": [
+    {
+      "id": "TC-120-widget-mount-pass",
+      "acId": "AC-9001-1",
+      "description": "AC-9001-1 anatomy proof",
+      "status": "pending",
+      "testPointer": "test/blueprint/edge-cloudflare-turnstile-anatomy.test.js::widget mount fixture renders the Turnstile iframe from Cloudflare origin only and populates the token on submit (TC-120-widget-mount-pass)"
+    }
+  ],
+  "status": "draft"
+}

package/rcf/test-suites/ts-121.json

@@ -0,0 +1,22 @@
+{
+  "createdAt": "2026-09-07T19:56:40.831Z",
+  "updatedAt": "2026-09-07T19:56:41.018Z",
+  "purpose": "Cover AC-9002-1 via anatomy test: secret-shape source-tree scan reports zero inline literals; every TURNSTILE_SECRET read is env-shaped",
+  "testLevel": "unit",
+  "acIds": [
+    "AC-9002-1"
+  ],
+  "id": "TS-121",
+  "usId": "US-9002",
+  "title": "T-5 AC-9002-1 anatomy proof",
+  "testCases": [
+    {
+      "id": "TC-121-secret-shape-scan",
+      "acId": "AC-9002-1",
+      "description": "AC-9002-1 anatomy proof",
+      "status": "pending",
+      "testPointer": "test/blueprint/edge-cloudflare-turnstile-anatomy.test.js::secret-shape scan reports env-shaped reads only and no inline literals in the pack fixture (TC-121-secret-shape-scan)"
+    }
+  ],
+  "status": "draft"
+}

package/rcf/test-suites/ts-122.json

@@ -0,0 +1,22 @@
+{
+  "createdAt": "2026-09-07T19:56:41.203Z",
+  "updatedAt": "2026-09-07T19:56:41.407Z",
+  "purpose": "Cover AC-9101-1 via anatomy test: live POST to Cloudflare siteverify endpoint with pinned always-pass secret returns success:true; handler responds 200",
+  "testLevel": "integration",
+  "acIds": [
+    "AC-9101-1"
+  ],
+  "id": "TS-122",
+  "usId": "US-9101",
+  "title": "T-5 AC-9101-1 anatomy proof",
+  "testCases": [
+    {
+      "id": "TC-122-siteverify-pass",
+      "acId": "AC-9101-1",
+      "description": "AC-9101-1 anatomy proof",
+      "status": "pending",
+      "testPointer": "test/blueprint/edge-cloudflare-turnstile-anatomy.test.js::siteverify pass posts to Cloudflare with the always-pass secret and returns success true (TC-122-siteverify-pass)"
+    }
+  ],
+  "status": "draft"
+}

package/rcf/test-suites/ts-123.json

@@ -0,0 +1,22 @@
+{
+  "createdAt": "2026-09-07T19:56:41.594Z",
+  "updatedAt": "2026-09-07T19:56:41.779Z",
+  "purpose": "Cover AC-9102-1 via anatomy test: live POST to Cloudflare siteverify endpoint with pinned always-fail secret returns success:false; handler responds 400; event records shape carries no token or secret",
+  "testLevel": "integration",
+  "acIds": [
+    "AC-9102-1"
+  ],
+  "id": "TS-123",
+  "usId": "US-9102",
+  "title": "T-5 AC-9102-1 anatomy proof",
+  "testCases": [
+    {
+      "id": "TC-123-siteverify-fail-secrecy",
+      "acId": "AC-9102-1",
+      "description": "AC-9102-1 anatomy proof",
+      "status": "pending",
+      "testPointer": "test/blueprint/edge-cloudflare-turnstile-anatomy.test.js::siteverify fail returns success false and event records carry sitekeyHash outcome and timestamp only (TC-123-siteverify-fail-secrecy)"
+    }
+  ],
+  "status": "draft"
+}

package/rcf/test-suites/ts-124.json

@@ -0,0 +1,22 @@
+{
+  "createdAt": "2026-09-07T19:56:41.965Z",
+  "updatedAt": "2026-09-07T19:56:42.150Z",
+  "purpose": "Cover AC-9201-1 via anatomy test: guard-shape source-tree scan asserts every elicited surface carries a token-required guard; a missing-token submit is refused with 400 by the pack fixture",
+  "testLevel": "integration",
+  "acIds": [
+    "AC-9201-1"
+  ],
+  "id": "TS-124",
+  "usId": "US-9201",
+  "title": "T-5 AC-9201-1 anatomy proof",
+  "testCases": [
+    {
+      "id": "TC-124-guard-shape-refuse",
+      "acId": "AC-9201-1",
+      "description": "AC-9201-1 anatomy proof",
+      "status": "pending",
+      "testPointer": "test/blueprint/edge-cloudflare-turnstile-anatomy.test.js::guard shape scan and pack-fixture missing-token submit refuses with 400 (TC-124-guard-shape-refuse)"
+    }
+  ],
+  "status": "draft"
+}

package/rcf/test-suites/ts-125.json

@@ -0,0 +1,22 @@
+{
+  "createdAt": "2026-09-07T19:56:42.335Z",
+  "updatedAt": "2026-09-07T19:56:42.521Z",
+  "purpose": "Cover AC-9301-1 via anatomy test: composition contract is realised in the pack fixture magic-link mint route; the mint reads the Turnstile guard before invoking the mint",
+  "testLevel": "unit",
+  "acIds": [
+    "AC-9301-1"
+  ],
+  "id": "TS-125",
+  "usId": "US-9301",
+  "title": "T-5 AC-9301-1 anatomy proof",
+  "testCases": [
+    {
+      "id": "TC-125-composition-wire",
+      "acId": "AC-9301-1",
+      "description": "AC-9301-1 anatomy proof",
+      "status": "pending",
+      "testPointer": "test/blueprint/edge-cloudflare-turnstile-anatomy.test.js::composition wire on the pack fixture magic-link mint reads the Turnstile guard first (TC-125-composition-wire)"
+    }
+  ],
+  "status": "draft"
+}

package/rcf/test-suites/ts-126.json

@@ -0,0 +1,22 @@
+{
+  "createdAt": "2026-09-07T19:56:42.706Z",
+  "updatedAt": "2026-09-07T19:56:42.891Z",
+  "purpose": "Cover AC-9302-1 via anatomy test: magic-link mint refusal on missing and on always-fail token; no mint fires",
+  "testLevel": "integration",
+  "acIds": [
+    "AC-9302-1"
+  ],
+  "id": "TS-126",
+  "usId": "US-9302",
+  "title": "T-5 AC-9302-1 anatomy proof",
+  "testCases": [
+    {
+      "id": "TC-126-magic-link-guard-refuse",
+      "acId": "AC-9302-1",
+      "description": "AC-9302-1 anatomy proof",
+      "status": "pending",
+      "testPointer": "test/blueprint/edge-cloudflare-turnstile-anatomy.test.js::magic-link mint route refuses on missing token and on always-fail token (TC-126-magic-link-guard-refuse)"
+    }
+  ],
+  "status": "draft"
+}

package/rcf/test-suites/ts-127.json

@@ -0,0 +1,22 @@
+{
+  "createdAt": "2026-09-07T19:56:43.076Z",
+  "updatedAt": "2026-09-07T19:56:43.260Z",
+  "purpose": "Cover AC-9401-1 via anatomy test: pack fixture accepts mode=managed, mode=non-interactive and mode=invisible and each renders with a Cloudflare-origin iframe only",
+  "testLevel": "integration",
+  "acIds": [
+    "AC-9401-1"
+  ],
+  "id": "TS-127",
+  "usId": "US-9401",
+  "title": "T-5 AC-9401-1 anatomy proof",
+  "testCases": [
+    {
+      "id": "TC-127-widget-mode-enum",
+      "acId": "AC-9401-1",
+      "description": "AC-9401-1 anatomy proof",
+      "status": "pending",
+      "testPointer": "test/blueprint/edge-cloudflare-turnstile-anatomy.test.js::widget mode enum honours managed non-interactive and invisible on the pack fixture (TC-127-widget-mode-enum)"
+    }
+  ],
+  "status": "draft"
+}

package/rcf/test-suites/ts-130.json

@@ -0,0 +1,22 @@
+{
+  "createdAt": "2026-09-07T21:41:27.755Z",
+  "updatedAt": "2026-09-07T21:41:28.044Z",
+  "purpose": "Cover AC-10001-1 via the T-6 anatomy test in test/blueprint/edge-cloudflare-rate-limiting-anatomy.test.js.",
+  "testLevel": "integration",
+  "acIds": [
+    "AC-10001-1"
+  ],
+  "id": "TS-130",
+  "usId": "US-10001",
+  "title": "T-6 AC-10001-1 anatomy proof",
+  "testCases": [
+    {
+      "id": "TC-130-manifest-presence-pass",
+      "acId": "AC-10001-1",
+      "description": "AC-10001-1 anatomy proof (T-6 rate-limiting slice, TC-130-manifest-presence-pass)",
+      "status": "pending",
+      "testPointer": "test/blueprint/edge-cloudflare-rate-limiting-anatomy.test.js::T-6 rate-limiting AC-10001-1 anatomy proof (TC-130-manifest-presence-pass)"
+    }
+  ],
+  "status": "draft"
+}