rcf-lite 0.22.0 → 0.24.0

package/rcf/user-stories/us-4301.json

@@ -0,0 +1,78 @@
+{
+  "createdAt": "2026-09-06T20:28:34.000Z",
+  "updatedAt": "2026-09-06T20:28:34.000Z",
+  "asA": "shelf consumer applying the jobs-background v1.0.0 blueprint",
+  "iWant": "the shipped blueprint files with 22 contributions, five probes, an extension to the shared sample-app fixture wiring the jobs runtime and scheduler on top of the T-3 in-memory queue seam, plus gate-runnable proof that apply refuses on a bare project with exit 3 and the stable message id, --allow-no-queue-yet writes a sidecar note, and every probe passes on the canonical fixture state",
+  "soThat": "a rcf-lite project applying this blueprint gets a job-definition contract with retry policy and timeout, an elicited scheduler (inProcess for now, workerCron or external for shipped adapters, workflows reserved for v1.1.0), a metadata-only run-log event stream at four moments, and the backgroundJobs capability future consumer blueprints can compose on; the T-5 capability-consumer mechanism is exercised end to end through the queue-capability path with runtime-observable ACs proven by probes the HQ gate runs against the shared sample-app fixture",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-4301-1",
+      "description": "The shelf carries blueprints/jobs-background/blueprint.json declaring slug jobs-background, version 1.0.0, category jobs, 22 contributions in the 6 REQ / 9 US / 3 TAC / 4 ADR groups per infra round 5 spec section 5.4; capabilities is [backgroundJobs]; suggestedCompanions declares logging and errorHandling with spec section 5.4 reasons; providesRoles is absent; requiresAppliedCapabilities equals {capabilities:[queue],allowSkipFlag:allow-no-queue-yet,refusalMessageId:jobs-background-no-queue}; every ADR contribution entry carries a non-null standardsTraceClause per section 8a.2.",
+      "given": "the shelf tree after this blueprint lands",
+      "when": "jq queries against blueprints/jobs-background/blueprint.json",
+      "then": "jq .slug returns jobs-background; jq .version returns 1.0.0; jq .contributions | length returns 22; jq .capabilities returns [backgroundJobs]; jq .suggestedCompanions | length returns 2; jq .requiresAppliedCapabilities.capabilities returns [queue]; jq .requiresAppliedCapabilities.allowSkipFlag returns allow-no-queue-yet; jq .requiresAppliedCapabilities.refusalMessageId returns jobs-background-no-queue; jq .contributions[] | select(.kind==adr) | .standardsTraceClause returns a non-null string for every entry",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-4301-2",
+      "description": "rcf define blueprint add ./blueprints/jobs-background on a bare fresh init project with no queue-capability provider applied refuses with exit 3 and the stderr message opens with the tag [jobs-background-no-queue] and explicitly names messaging-queue-cloudflare as the shipped provider and --allow-no-queue-yet as the override, per infra round 5 spec section 10 Q3 default asserting BOTH exit code AND stable message id.",
+      "given": "a fresh rcf init scratch project with no applied blueprints",
+      "when": "rcf define blueprint add ./blueprints/jobs-background runs",
+      "then": "exit code is 3; stderr contains the substring [jobs-background-no-queue]; stderr contains the substring messaging-queue-cloudflare; stderr contains the substring --allow-no-queue-yet; nothing is written to rcf/manifest.json under blueprints[] for jobs-background",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-4301-3",
+      "description": "rcf define blueprint add ./blueprints/jobs-background --allow-no-queue-yet on the same bare project exits 0 and writes the sidecar rcf/blueprints/jobs-background.applied.json with allowNoAuthYet true, appliedCapabilities [], and a notes field naming the missing queue capability and the --allow-no-queue-yet override flag (queue-family prose, not auth-family prose); the T-5 mechanism's shipped sidecar path supersedes the spec section 5.4 prose reference to manifest.blueprints[jobs-background].source.notes because the applied-blueprint-record schema in rcf-schemas 0.6.1 is closed and cannot carry the notes field.",
+      "given": "a fresh rcf init scratch project with no applied blueprints",
+      "when": "rcf define blueprint add ./blueprints/jobs-background --allow-no-queue-yet runs",
+      "then": "exit code is 0; the file rcf/blueprints/jobs-background.applied.json exists; its slug is jobs-background; its allowNoAuthYet is true; its appliedCapabilities is []; its notes contains the substring no queue yet and the substring --allow-no-queue-yet and the substring queue; its notes does NOT contain the substring no auth yet nor no secrets-management yet",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-4301-4",
+      "description": "rcf define blueprint add ./blueprints/jobs-background on a fresh init project that first applied messaging-queue-cloudflare exits 0 and the sidecar rcf/blueprints/jobs-background.applied.json records appliedCapabilities containing queue via the T-5 capability discovery mechanism (union across applied blueprint capability declarations); the spec section 5.4 prose reference to jq '.blueprints[] | select(.slug==\"jobs-background\") | .appliedCapabilities' rcf/manifest.json is superseded by the shipped mechanism which lives on the sidecar.",
+      "given": "a fresh rcf init scratch project with messaging-queue-cloudflare applied first",
+      "when": "rcf define blueprint add ./blueprints/jobs-background runs",
+      "then": "exit code is 0; the file rcf/blueprints/jobs-background.applied.json exists; its slug is jobs-background; its appliedCapabilities contains the string queue; its allowNoAuthYet is undefined; its notes is undefined",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-4301-5",
+      "description": "Every probe module under blueprints/jobs-background/contributions/probes/ exports the spec section 3.2 verdict envelope with an anchorAcId matching a contributed AC id on the blueprint (apply-time-refusal.mjs anchorAcId AC-jobs-requiresQueue, apply-time-override.mjs AC-jobs-overrideRecorded, fake-clock-cron.mjs AC-jobs-scheduledRunsOnCron, retry-and-fail.mjs AC-jobs-retryOnHandlerFailure, event-secrecy.mjs AC-jobs-eventSecrecy); every run-<probe-name>.mjs shim exits 0 on a fresh run of the shared sample-app fixture with the T-3 in-memory queue seam active; every per-blueprint report at .rcf/reports/blueprints/jobs-background/<probe-name>.json carries aggregateVerdict pass.",
+      "given": "the shared sample-app fixture at packages/rcf-lite/test/fixtures/infra-s3-and-queue/ with the T-3 in-memory queue-driver seam active (SDR-3-a coordinator ruling: wrangler dev is not on this build host and the in-memory realisation of the Cloudflare Queues binding shape is the shipped local seam)",
+      "when": "each of the five run-<probe-name>.mjs shims runs against the fixture in sequence",
+      "then": "every shim exits 0; every per-blueprint report file carries aggregateVerdict pass; every result carries an anchorAcId matching a contributed AC id on the blueprint",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-4301-6",
+      "description": "The shared sample-app fixture at packages/rcf-lite/test/fixtures/infra-s3-and-queue/ grows a jobs/ directory carrying two toy job-definition modules (send-welcome-email.mjs with retryPolicy {maxAttempts:3,backoff:exponential} and timeoutMs 60000, refresh-cache.mjs with retryPolicy {maxAttempts:5,backoff:constant} timeoutMs 10000 and cron every-minute), src/jobs-runtime.mjs realising the run-time (reads applied capabilities from the sidecar, registers job handlers with the queue consumer, fires the four lifecycle events per REQ-005), src/scheduler.mjs realising the inProcess scheduler with a fake-clock seam; two induced-failure switches SIMULATE_HANDLER_THROW and SIMULATE_PII_IN_JOB_INPUT are WIRED and driven live by the retry-and-fail.mjs and event-secrecy.mjs probes; the fixture README documents the two toy jobs, the jobs/ convention, the fake-clock switch, the elicited parameters and both induced-failure switches with paired probes.",
+      "given": "the shared fixture with the T-3 in-memory queue-driver seam and the T-4 jobs-runtime+scheduler wired on top",
+      "when": "each of the two induced-failure switches is set in turn and the paired probe runs",
+      "then": "SIMULATE_HANDLER_THROW true yields retry-and-fail report with attempts counter 1,2,3 across three jobStarted events with the same jobId followed by jobFailed with terminal code; SIMULATE_PII_IN_JOB_INPUT true yields event-secrecy report with aggregateVerdict pass proving the event whitelist blocks every PII input field; the fixture README documents each switch and the paired probe module by name",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-4301-7",
+      "description": "The blueprint ships a README, a CHANGELOG, a guide, and a docs/topics.md entry; the shelf-wide id-band registry table gains a jobs-background row at US band 30101-30899 / ADR-TAC suffix block 31xx across every shipped blueprint's docs/topics.md; packages/rcf-lite/docs/blueprint-authoring.md section 6a capability-declaration table gains one row for backgroundJobs naming the reserved sibling posture per infra round 5 spec section 5.6.",
+      "given": "the shelf tree after this blueprint lands",
+      "when": "grep queries walk every blueprint's docs/topics.md and the section 6a table",
+      "then": "packages/rcf-lite/docs/blueprint-authoring.md contains a table row beginning | backgroundJobs | naming jobs-background and the reserved sibling posture; every shipped blueprint's docs/topics.md carries a row beginning | jobs-background | with the 30101-30899 band and 31xx suffix; blueprints/jobs-background/README.md, CHANGELOG.md, guide/jobs-background.md, docs/topics.md, and the extended packages/rcf-lite/test/fixtures/infra-s3-and-queue/ all exist; the fixture README names the jobs-runtime boot line and the two wired induced-failure switches",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "usId": "US-4301",
+  "prdId": "PRD-001",
+  "reqId": "REQ-043",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "The jobs-background blueprint ships on the shelf with five probes wired to the T-3 in-memory queue seam"
+}

package/rcf/user-stories/us-5001.json

@@ -0,0 +1,27 @@
+{
+  "createdAt": "2026-09-07T10:18:40.349Z",
+  "updatedAt": "2026-09-07T10:20:10.276Z",
+  "usId": "US-5001",
+  "prdId": "PRD-001",
+  "reqId": "REQ-050",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-1 KV facade opens against the elicited KV binding on boot and emits facadeReady",
+  "asA": "shelf consumer applying the platform-cloudflare-kv v1.0.0 blueprint on a Workers project using the cf-platform fixture",
+  "iWant": "one KV facade module (src/kv-facade.mjs) that opens against the elicited KV binding on process boot and emits a facadeReady lifecycle event with a metadata-only payload",
+  "soThat": "boot ordering is observable, the ready-check seam is a single call site, and the applied project can compose its own bootstrapping around one predictable event",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-5001-1",
+      "description": "On process boot, the facade opens against the elicited KV binding (env.CACHE on the fixture) with a bounded list(limit:1) ready-check; once the ready-check resolves, a facadeReady event fires on the injected event sink with a payload of exactly {event, key, size, ttl, timestamp} where key is null, size is 0 and ttl is null. The facade exposes typed named domain verbs (get, getWithMetadata, put, delete, list) and does NOT re-export the raw KV binding.",
+      "given": "a Node or Worker process with the facade module imported and its factory invoked with the elicited binding",
+      "when": "the process boots and the facade ready() call resolves",
+      "then": "a facadeReady event fires on the injected event sink with the metadata-only payload; the facade exposes named domain verbs only; the raw binding is not re-exported",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tags": [
+    "blueprint:platform-cloudflare-kv"
+  ]
+}

package/rcf/user-stories/us-5002.json

@@ -0,0 +1,27 @@
+{
+  "createdAt": "2026-09-07T10:18:40.551Z",
+  "updatedAt": "2026-09-07T10:20:10.276Z",
+  "usId": "US-5002",
+  "prdId": "PRD-001",
+  "reqId": "REQ-050",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-1 KV facade module is the sole reader of the KV binding grep-verified on the applied fixture tree",
+  "asA": "shelf consumer applying platform-cloudflare-kv v1.0.0",
+  "iWant": "the KV binding reference (env.CACHE) to appear in exactly one source module (src/kv-facade.mjs)",
+  "soThat": "the vendor surface is diffused across zero call sites outside the facade, and a future adapter swap lands without moving any AC",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-5002-1",
+      "description": "A grep for env.CACHE in the applied fixture src/ tree returns exactly one file: src/kv-facade.mjs. No other module dereferences the raw KV binding. The public surface of src/kv-facade.mjs exports the createKvFacade factory only; the raw env.CACHE reference never crosses the module boundary.",
+      "given": "the applied project source tree after apply",
+      "when": "grep -rn env.CACHE walks the src/ tree",
+      "then": "the search returns one file src/kv-facade.mjs and no other match",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tags": [
+    "blueprint:platform-cloudflare-kv"
+  ]
+}

package/rcf/user-stories/us-5101.json

@@ -0,0 +1,36 @@
+{
+  "createdAt": "2026-09-07T10:18:40.753Z",
+  "updatedAt": "2026-09-07T10:20:10.276Z",
+  "usId": "US-5101",
+  "prdId": "PRD-001",
+  "reqId": "REQ-051",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-1 typed put get delete round-trip against the KV driver realises the Workers KV binding shape",
+  "asA": "shelf consumer applying platform-cloudflare-kv v1.0.0",
+  "iWant": "typed put and get verbs that round-trip a value through the KV driver realising the Workers KV binding shape",
+  "soThat": "the applied project can persist a small piece of state and read it back deterministically, in the same shape the real Workers KV binding would present",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-5101-1",
+      "description": "facade.put(key, value) writes a value; facade.get(key) returns the same bytes; both operations emit their paired lifecycle events (kvWrite on put, kvHit on get). The round-trip works against the in-memory KV driver in the fixture (kv-driver.mjs) whose binding shape matches the real Workers KV binding contract per https://developers.cloudflare.com/kv/api/.",
+      "given": "the facade wired to the in-memory KV driver in the cf-platform fixture",
+      "when": "the facade-round-trip probe puts a fixture key/value and reads it back",
+      "then": "the read returns the same bytes; the event sink records one kvWrite and one kvHit; the probe report aggregates to pass",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-5101-2",
+      "description": "facade.delete(key) removes a value; a subsequent facade.get(key) returns null and emits kvMiss.",
+      "given": "a key previously put via the facade",
+      "when": "facade.delete(key) then facade.get(key)",
+      "then": "the delete emits kvWrite; the get returns null and emits kvMiss",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tags": [
+    "blueprint:platform-cloudflare-kv"
+  ]
+}

package/rcf/user-stories/us-5102.json

@@ -0,0 +1,27 @@
+{
+  "createdAt": "2026-09-07T10:18:40.958Z",
+  "updatedAt": "2026-09-07T10:20:10.276Z",
+  "usId": "US-5102",
+  "prdId": "PRD-001",
+  "reqId": "REQ-051",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-1 list with prefix returns every key under the prefix with metadata shape intact",
+  "asA": "shelf consumer applying platform-cloudflare-kv v1.0.0",
+  "iWant": "facade.list({prefix}) to return every key under a prefix with the metadata shape intact",
+  "soThat": "the applied project can enumerate feature flags, sessions, or any prefix-scoped collection through one seam",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-5102-1",
+      "description": "The list-with-prefix probe puts 10 keys under the prefix flags/ (each with a metadata blob) and calls facade.list({prefix: flags/}). The result returns all 10 keys, each entry carrying {name, metadata}, and every name preserves the domain-visible key (without the fixture keyPrefix if one was set).",
+      "given": "10 keys put under a shared prefix through the facade",
+      "when": "facade.list({prefix: flags/}) runs",
+      "then": "the result carries 10 entries with correct name and metadata fields; the aggregate probe verdict is pass",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tags": [
+    "blueprint:platform-cloudflare-kv"
+  ]
+}

package/rcf/user-stories/us-5201.json

@@ -0,0 +1,36 @@
+{
+  "createdAt": "2026-09-07T10:18:41.162Z",
+  "updatedAt": "2026-09-07T10:20:10.276Z",
+  "usId": "US-5201",
+  "prdId": "PRD-001",
+  "reqId": "REQ-052",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-1 cache-aside helper: hit-then-miss with a fake clock proves one origin call within TTL and a second past TTL",
+  "asA": "shelf consumer applying platform-cloudflare-kv v1.0.0",
+  "iWant": "the cache-aside helper to read from KV first and fall back to origin on miss, writing back with the elicited TTL",
+  "soThat": "the origin surface (a database, a downstream service) is spared one call per cached hit within TTL",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-5201-1",
+      "description": "On first call, cache-aside.getOr(key, originFn) finds nothing in the facade, invokes originFn once, writes back with the elicited TTL, and returns the fresh value with source origin. On second call within TTL, the read is served from the facade (source cache) and originFn is NOT invoked (the invocation counter stays at 1).",
+      "given": "a fresh key and an origin function that increments a counter each call",
+      "when": "getOr(key, originFn) runs twice within TTL",
+      "then": "the invocation counter reaches 1; both calls return the same value; the second read reports source cache",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-5201-2",
+      "description": "After the TTL elapses (in-memory driver clock advances past the expiration), cache-aside.getOr(key, originFn) finds nothing and invokes originFn a second time. The invocation counter reaches 2.",
+      "given": "a key past its TTL",
+      "when": "getOr(key, originFn) runs after clock advance past TTL",
+      "then": "the invocation counter reaches 2; the returned value comes from origin",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tags": [
+    "blueprint:platform-cloudflare-kv"
+  ]
+}

package/rcf/user-stories/us-5301.json

@@ -0,0 +1,27 @@
+{
+  "createdAt": "2026-09-07T10:18:41.367Z",
+  "updatedAt": "2026-09-07T10:20:10.276Z",
+  "usId": "US-5301",
+  "prdId": "PRD-001",
+  "reqId": "REQ-053",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-1 lifecycle events fire on facadeReady kvHit kvMiss kvWrite with metadata-only payload",
+  "asA": "shelf consumer applying platform-cloudflare-kv v1.0.0",
+  "iWant": "the facade to emit facadeReady kvHit kvMiss kvWrite events with metadata-only payload on the injected sink",
+  "soThat": "the applied logging companion can render KV activity without ever writing a body byte to the log stream",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-5301-1",
+      "description": "Each lifecycle event emitted by the facade carries EXACTLY the whitelist {event, key, size, ttl, timestamp}. No body value, no metadata blob, no additional field ever appears on the record the sink receives.",
+      "given": "the facade wired to a spy event sink, with a mix of put/get/delete/list operations",
+      "when": "the operations run",
+      "then": "the sink records each event with only the whitelist keys; any extra key trips the probe",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tags": [
+    "blueprint:platform-cloudflare-kv"
+  ]
+}

package/rcf/user-stories/us-5302.json

@@ -0,0 +1,27 @@
+{
+  "createdAt": "2026-09-07T10:18:41.585Z",
+  "updatedAt": "2026-09-07T10:20:10.276Z",
+  "usId": "US-5302",
+  "prdId": "PRD-001",
+  "reqId": "REQ-053",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-1 event secrecy: no body bytes no PII no user id beyond the key ever reach the event sink",
+  "asA": "shelf consumer applying platform-cloudflare-kv v1.0.0",
+  "iWant": "the event-secrecy probe to prove no body bytes or PII ever reach the event sink",
+  "soThat": "the operator can trust that a KV that holds a PII fixture (users/1234/profile with SSN) never leaks the body to the log stream even under a mutation-run",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-5302-1",
+      "description": "The event-secrecy probe puts, gets and deletes a PII fixture (key users/1234/profile, body {ssn: REDACTED-fixture}); every event record on the sink carries only the whitelist and no substring of the SSN, no substring of the user id beyond the key itself, and no substring of the body. A mutation-run turning on SIMULATE_PII_LEAK flips the probe to fail with the leaked field named.",
+      "given": "the facade wired to a spy sink with a PII fixture",
+      "when": "put/get/delete operations run on the PII key",
+      "then": "the recorded events contain only the whitelist; PII-substring scan returns zero hits; the mutation-run under SIMULATE_PII_LEAK trips the probe to fail",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tags": [
+    "blueprint:platform-cloudflare-kv"
+  ]
+}

package/rcf/user-stories/us-5401.json

@@ -0,0 +1,27 @@
+{
+  "createdAt": "2026-09-07T10:18:41.795Z",
+  "updatedAt": "2026-09-07T10:20:10.276Z",
+  "usId": "US-5401",
+  "prdId": "PRD-001",
+  "reqId": "REQ-054",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-1 real-account eventual-consistency smoke: write eventually appears on a global read within a bounded 60-second cap or records accountBoundSkipped in CI",
+  "asA": "shelf consumer applying platform-cloudflare-kv v1.0.0 in CI with real Cloudflare credentials",
+  "iWant": "the real-account eventual-consistency smoke to open the facade against a real KV namespace and observe the write eventually appearing on a global read",
+  "soThat": "the applied project has one probe that exercises the real vendor surface (not just the in-memory driver) and closes the mechanism-reach gap between fixture and production",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-5401-1",
+      "description": "When CI_HAS_CLOUDFLARE_ACCOUNT is set (with CF_ACCOUNT_ID, CF_KV_NAMESPACE_ID and CF_API_TOKEN), the real-account probe opens the facade against the real KV namespace via the Workers KV REST API, writes a fixture key, polls the same key with bounded 60-second cap, and asserts the value eventually returns. Without CI_HAS_CLOUDFLARE_ACCOUNT the probe records accountBoundSkipped true and the aggregate flips to pass per spec section 3.5. The probe cleans up its written key on exit.",
+      "given": "the real-account smoke shim with or without CI_HAS_CLOUDFLARE_ACCOUNT",
+      "when": "the shim runs",
+      "then": "with the env var: the write eventually returns within 60 seconds and the aggregate is pass; without: the aggregate is pass and the report records accountBoundSkipped true",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tags": [
+    "blueprint:platform-cloudflare-kv"
+  ]
+}

package/rcf/user-stories/us-6001.json

@@ -0,0 +1,27 @@
+{
+  "createdAt": "2026-09-07T12:28:01.537Z",
+  "updatedAt": "2026-09-07T12:28:01.537Z",
+  "asA": "shelf consumer applying the platform-cloudflare-cron-triggers v1.0.0 blueprint on a Workers project using the cf-platform fixture",
+  "iWant": "one scheduled() handler module (src/scheduled.mjs) that opens against the elicited cron triggers on process boot, wires the dispatcher and event sink, and emits a cronReady lifecycle event with a metadata-only payload",
+  "soThat": "boot ordering is observable, the scheduled seam is a single call site, and the applied project can compose its own bootstrapping around one predictable event",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-6001-1",
+      "description": "On process boot, the scheduled handler binds against the elicited cron triggers (the [triggers] crons block in wrangler.toml on the fixture), wires the dispatcher and the injected event sink, and emits a cronReady event on the sink with a payload of exactly {event, key, size, ttl, timestamp} where key is null, size is 0 and ttl is null. The scheduled handler does NOT dereference the KV binding (env.CACHE stays owned by the T-1 facade).",
+      "given": "a Node or Worker process with the scheduled handler module imported and its factory invoked with the elicited configuration",
+      "when": "the process boots and the scheduled handler ready() call resolves",
+      "then": "a cronReady event fires on the injected event sink with the metadata-only payload; the module does not dereference env.CACHE",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tags": [
+    "blueprint:platform-cloudflare-cron-triggers"
+  ],
+  "usId": "US-6001",
+  "prdId": "PRD-001",
+  "reqId": "REQ-060",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-2 scheduled() handler opens against the elicited cron triggers on boot and emits cronReady"
+}

package/rcf/user-stories/us-6002.json

@@ -0,0 +1,27 @@
+{
+  "createdAt": "2026-09-07T12:28:01.742Z",
+  "updatedAt": "2026-09-07T12:28:01.742Z",
+  "asA": "reviewer verifying the platform-cloudflare-cron-triggers v1.0.0 blueprint at mechanism reach",
+  "iWant": "the wrangler-test-scheduled probe to spawn wrangler dev --test-scheduled on the cf-platform fixture, drive its scheduled-fire route with a cron expression declared in wrangler.toml, assert a cronFired event fires on the sink and wrangler exits cleanly",
+  "soThat": "the shipped scheduled() handler is proven wired to the vendor's CLI seam, not only to an in-process spy",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-6002-1",
+      "description": "The wrangler-test-scheduled probe spawns wrangler dev --test-scheduled from the cf-platform fixture, waits bounded 30 seconds for the CLI to bind, drives its scheduled-fire route with an expression from wrangler.toml's [triggers] crons block, asserts a cronFired event fires on the injected sink with metadata {expression, scheduledTime, outcome, duration}, kills wrangler cleanly on exit, and returns aggregateVerdict: pass. On a shipped wrangler regression that prevents --test-scheduled from binding, the probe returns aggregateVerdict: warn with the observed CLI stderr quoted and the mechanism-reach gap noted, per section 3.1 pass-with-skip conventions.",
+      "given": "wrangler installed as a devDependency on the cf-platform fixture and the [triggers] crons block declared in wrangler.toml",
+      "when": "the probe runs from the fixture directory",
+      "then": "wrangler dev --test-scheduled binds, the scheduled-fire route drives a cronFired event and wrangler exits cleanly",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tags": [
+    "blueprint:platform-cloudflare-cron-triggers"
+  ],
+  "usId": "US-6002",
+  "prdId": "PRD-001",
+  "reqId": "REQ-060",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-2 wrangler dev --test-scheduled fires cronFired on the fixture handler"
+}

package/rcf/user-stories/us-6003.json

@@ -0,0 +1,27 @@
+{
+  "createdAt": "2026-09-07T12:28:01.964Z",
+  "updatedAt": "2026-09-07T12:28:01.964Z",
+  "asA": "operator validating platform-cloudflare-cron-triggers v1.0.0 against a real Cloudflare account",
+  "iWant": "the real-account-scheduled-smoke probe to schedule a per-minute cron on a real Worker, wait bounded 90 seconds and assert cronFired fires at least once",
+  "soThat": "the shipped scheduled() surface is proven against the vendor's global cron scheduler, not only against wrangler dev",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-6003-1",
+      "description": "The real-account-scheduled-smoke probe, when CI_HAS_CLOUDFLARE_ACCOUNT=true and the paired CF_ACCOUNT_ID / CF_WORKER_NAME / CF_API_TOKEN env vars are set, deploys a scheduled Worker with a per-minute cron expression (* * * * *), waits bounded 90 seconds (poll every 5s) for a cronFired event to appear on the Worker's log stream, and returns aggregateVerdict: pass. Without CI_HAS_CLOUDFLARE_ACCOUNT the probe records accountBoundSkipped: true and aggregates to pass per spec section 3.5.",
+      "given": "a real Cloudflare account with the paired env vars, or no such account and CI_HAS_CLOUDFLARE_ACCOUNT unset",
+      "when": "the probe runs",
+      "then": "with the account: cronFired appears within 90s and the probe passes. Without the account: the probe records accountBoundSkipped: true and exits 0.",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tags": [
+    "blueprint:platform-cloudflare-cron-triggers"
+  ],
+  "usId": "US-6003",
+  "prdId": "PRD-001",
+  "reqId": "REQ-060",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-2 real-account live-cron smoke fires cronFired at least once against a real Cloudflare Worker"
+}

package/rcf/user-stories/us-6101.json

@@ -0,0 +1,36 @@
+{
+  "createdAt": "2026-09-07T12:28:02.169Z",
+  "updatedAt": "2026-09-07T12:28:02.169Z",
+  "asA": "developer whose Worker needs to schedule two or more distinct workloads on distinct cron cadences",
+  "iWant": "one dispatcher module (src/dispatcher.mjs) that accepts an ordered map of cron expressions to handler functions and, on every scheduled invocation, routes to the matched handler with a bounded context",
+  "soThat": "one wrangler.toml [triggers] block with multiple cron expressions cleanly maps to distinct handler code paths without hand-rolled conditionals",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-6101-1",
+      "description": "createDispatcher({routes: [{expression, handler}, ...], eventSink}) returns a dispatch(event) function. Calling dispatch({cron: '* * * * *', scheduledTime}) invokes exactly the handler whose expression is '* * * * *' and passes {expression, scheduledTime, sink} to it; no other route's handler is called on that dispatch.",
+      "given": "a dispatcher wired with two routes and two spy handlers",
+      "when": "dispatch is called with a specific expression",
+      "then": "only the matched spy handler is invoked exactly once with the bounded context",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-6101-2",
+      "description": "Calling dispatch({cron: expressionNotInRoutes, scheduledTime}) does NOT invoke any handler, fires a cronUnmatched event on the sink with metadata {expression, scheduledTime, outcome: unmatched, duration: 0} and returns without side effect.",
+      "given": "a dispatcher wired with two routes and two spy handlers",
+      "when": "dispatch is called with an expression not in the routes",
+      "then": "no spy is called, a cronUnmatched event fires, and dispatch returns without side effect",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tags": [
+    "blueprint:platform-cloudflare-cron-triggers"
+  ],
+  "usId": "US-6101",
+  "prdId": "PRD-001",
+  "reqId": "REQ-061",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-2 dispatcher routes multiple cron expressions to distinct handlers by expression match"
+}

package/rcf/user-stories/us-6201.json

@@ -0,0 +1,36 @@
+{
+  "createdAt": "2026-09-07T12:28:02.375Z",
+  "updatedAt": "2026-09-07T12:28:02.375Z",
+  "asA": "operator observing the timeliness of scheduled work on a Worker",
+  "iWant": "the dispatcher to classify every fire against an elicited skew window and record cronSkewed for late fires with the delta",
+  "soThat": "the applied logging companion surfaces cron drift as a first-class signal without every handler having to keep its own clock",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-6201-1",
+      "description": "With an elicited skew window of 30 seconds and a fake clock aligned to scheduledTime, dispatching a scheduled event fires cronFired with {expression, scheduledTime, outcome: onTime, duration: >=0} on the sink; no cronSkewed event fires for that dispatch.",
+      "given": "a dispatcher configured with skewToleranceMs=30000 and a fake clock aligned to scheduledTime",
+      "when": "an event is dispatched",
+      "then": "a cronFired event fires with outcome onTime and no cronSkewed fires",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-6201-2",
+      "description": "With an elicited skew window of 30 seconds and a fake clock advanced 60000ms past scheduledTime, dispatching a scheduled event fires cronSkewed with {expression, scheduledTime, outcome: skewed, duration: >=0, deltaMs: 60000} on the sink; the routed handler still runs.",
+      "given": "a dispatcher configured with skewToleranceMs=30000 and a fake clock advanced 60000ms past scheduledTime",
+      "when": "an event is dispatched",
+      "then": "a cronSkewed event fires with the observed delta and the handler still runs",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tags": [
+    "blueprint:platform-cloudflare-cron-triggers"
+  ],
+  "usId": "US-6201",
+  "prdId": "PRD-001",
+  "reqId": "REQ-062",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-2 skew tolerance: fires inside the elicited window are onTime; outside record cronSkewed with delta"
+}

package/rcf/user-stories/us-6301.json

@@ -0,0 +1,36 @@
+{
+  "createdAt": "2026-09-07T12:28:02.582Z",
+  "updatedAt": "2026-09-07T12:28:02.582Z",
+  "asA": "operator observing long-running scheduled work on a Worker",
+  "iWant": "the dispatcher to fire cronStalled at the moment a handler's observed duration crosses the elicited soft budget, without terminating the handler",
+  "soThat": "the applied logging companion surfaces stalled fires as a first-class signal, and the Worker's own CPU budget remains the vendor's concern",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-6301-1",
+      "description": "With softBudgetMs=100 and a spy handler that resolves after 250ms of fake-clock time, dispatching fires exactly one cronStalled event on the sink with {expression, scheduledTime, outcome: stalled, duration: >=100, softBudgetMs: 100} at the moment the observed duration crosses 100ms.",
+      "given": "a dispatcher configured with softBudgetMs=100 and a spy handler that resolves after 250ms fake-clock",
+      "when": "an event is dispatched",
+      "then": "a cronStalled event fires exactly once with the observed duration at or past the budget",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-6301-2",
+      "description": "With softBudgetMs=100 and a spy handler that resolves after 250ms of fake-clock time, the dispatcher does NOT terminate the handler on the soft-budget breach; the handler runs to completion, resolves, and a final cronFired event follows the cronStalled record with the total duration.",
+      "given": "a dispatcher configured with softBudgetMs=100 and a spy handler that resolves after 250ms fake-clock",
+      "when": "an event is dispatched",
+      "then": "the handler runs to completion and a cronFired follows the cronStalled record",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tags": [
+    "blueprint:platform-cloudflare-cron-triggers"
+  ],
+  "usId": "US-6301",
+  "prdId": "PRD-001",
+  "reqId": "REQ-063",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-2 soft budget: a handler running past the elicited budget logs cronStalled and continues"
+}

package/rcf/user-stories/us-6302.json

@@ -0,0 +1,27 @@
+{
+  "createdAt": "2026-09-07T12:28:02.788Z",
+  "updatedAt": "2026-09-07T12:28:02.788Z",
+  "asA": "security reviewer reading the applied logging companion's stream",
+  "iWant": "every cron lifecycle event record to carry only {event, expression, scheduledTime, outcome, duration} and optional numeric metadata fields; never a handler input, closure or PII substring",
+  "soThat": "the logging stream stays safe to ship to any downstream sink without a per-blueprint scrub pass",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-6302-1",
+      "description": "The event-secrecy probe drives the dispatcher with a spy handler that receives a PII fixture ({userId, ssn}) via a closure, and drives put/get/delete-style operations on a fixture key. The probe asserts (layer 1) every event record's keys are a subset of the allow-list {event, expression, scheduledTime, outcome, duration, softBudgetMs, deltaMs}; and (layer 2) the JSON serialisation of every record (excluding the expression field, which is a legitimate literal from wrangler.toml) contains no PII substring (userId numeric, ssn placeholder). SIMULATE_PII_LEAK=true injects a wrapper sink that forwards the closure onto the record; the probe surfaces the forbidden keys and the leaked substrings and returns aggregateVerdict: fail.",
+      "given": "the event-secrecy probe run under both modes",
+      "when": "the shipped code path runs without the switch; the mutation-path runs with SIMULATE_PII_LEAK=true",
+      "then": "shipped: aggregateVerdict pass with zero forbidden keys and zero PII hits. Switch on: aggregateVerdict fail with the leaked fields named.",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tags": [
+    "blueprint:platform-cloudflare-cron-triggers"
+  ],
+  "usId": "US-6302",
+  "prdId": "PRD-001",
+  "reqId": "REQ-063",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-2 event secrecy: every scheduled-side event record carries only metadata; no closure or PII"
+}

package/rcf/user-stories/us-7001.json

@@ -0,0 +1,27 @@
+{
+  "createdAt": "2026-09-07T14:11:53.037Z",
+  "updatedAt": "2026-09-07T14:13:26.508Z",
+  "usId": "US-7001",
+  "prdId": "PRD-001",
+  "reqId": "REQ-070",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-3 DO facade opens against env.CELL and env.HUB and emits namespaceReady",
+  "asA": "shelf consumer applying the platform-cloudflare-durable-objects v1.0.0 blueprint on a Workers project using the cf-platform fixture",
+  "iWant": "one DO facade module (src/do-facade.mjs) that opens against env.CELL and env.HUB on boot, wires the injected event sink and emits a namespaceReady lifecycle event with a metadata-only payload",
+  "soThat": "boot ordering is observable, the DO namespace seam is a single call site, and the applied project can compose its own bootstrapping around one predictable event",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-7001-1",
+      "description": "On process boot, createDoFacadeInProcess (the in-process seam over the shipped facade code path) wires the injected event sink and emits a namespaceReady event on the sink with a payload of exactly {event, key, size, ttl, timestamp} where key is null, size is 0 and ttl is null. facade.cell(name) and facade.hub(name) return the registered SingleCellObject and HubObject instances.",
+      "given": "a facade wired with in-process SingleCellObject and HubObject instances and a spy event sink",
+      "when": "the facade ready() call resolves",
+      "then": "a namespaceReady event fires exactly once on the sink with the metadata-only payload; the registered handles return the instances",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tags": [
+    "blueprint:platform-cloudflare-durable-objects"
+  ]
+}

package/rcf/user-stories/us-7002.json

@@ -0,0 +1,27 @@
+{
+  "createdAt": "2026-09-07T14:11:54.952Z",
+  "updatedAt": "2026-09-07T14:13:26.508Z",
+  "usId": "US-7002",
+  "prdId": "PRD-001",
+  "reqId": "REQ-070",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-3 real-account storage smoke records accountBoundSkipped without env var",
+  "asA": "operator validating platform-cloudflare-durable-objects v1.0.0 against a real Cloudflare account",
+  "iWant": "the real-account-storage-smoke probe to record accountBoundSkipped and aggregate to pass when CI_HAS_CLOUDFLARE_ACCOUNT is unset",
+  "soThat": "the shipped account-bound seam matches the Clerk pattern (skip-in-CI when no account, run when one is available) per spec section 3.5",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-7002-1",
+      "description": "The real-account-storage-smoke probe with CI_HAS_CLOUDFLARE_ACCOUNT unset returns a single result with anchorAcId AC-33112-1 and verdict pass; the report carries accountBoundSkipped=true and aggregates to pass; exit code 0. With CI_HAS_CLOUDFLARE_ACCOUNT=true but any of CF_ACCOUNT_ID, CF_DO_NAMESPACE_ID or CF_API_TOKEN missing, the probe returns fail naming the missing keys.",
+      "given": "the real-account-storage-smoke probe module",
+      "when": "run without CI_HAS_CLOUDFLARE_ACCOUNT, and then with the env var but no paired creds",
+      "then": "the first run reports accountBoundSkipped and passes; the second reports the missing keys and fails",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tags": [
+    "blueprint:platform-cloudflare-durable-objects"
+  ]
+}