rcf-lite 0.22.0 → 0.24.0

package/rcf/user-stories/us-7101.json

@@ -0,0 +1,27 @@
+{
+  "createdAt": "2026-09-07T14:11:53.254Z",
+  "updatedAt": "2026-09-07T14:13:26.508Z",
+  "usId": "US-7101",
+  "prdId": "PRD-001",
+  "reqId": "REQ-071",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-3 single-cell concurrent increments serialise per instance and return witness of prior write",
+  "asA": "developer whose Worker needs an authoritative counter, session store or lock behind a swappable boundary",
+  "iWant": "one SingleCellObject instance to observe concurrent increments in per-instance FIFO order and return the sum plus a written witness",
+  "soThat": "two concurrent callers cannot silently overwrite each other and a domain assertion can prove the write happened before the read",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-7101-1",
+      "description": "Two concurrent increment(1) invocations against a SingleCellObject with counter 0 resolve to counters [1, 2] and witnesses [0, 1] in FIFO order; a subsequent read() returns counter 2.",
+      "given": "a SingleCellObject at counter 0",
+      "when": "two concurrent increment(1) calls fire and read() follows",
+      "then": "counters are [1,2], witnesses are [0,1], read returns 2",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tags": [
+    "blueprint:platform-cloudflare-durable-objects"
+  ]
+}

package/rcf/user-stories/us-7201.json

@@ -0,0 +1,27 @@
+{
+  "createdAt": "2026-09-07T14:11:53.463Z",
+  "updatedAt": "2026-09-07T14:13:26.508Z",
+  "usId": "US-7201",
+  "prdId": "PRD-001",
+  "reqId": "REQ-072",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-3 storage round-trip covers put/get/delete/list on both SQL and KV backends",
+  "asA": "developer configuring the storage backend on a new SingleCellObject",
+  "iWant": "the shipped storage driver factory to round-trip put/get/delete/list on both SQL and KV backends",
+  "soThat": "the applied project can elicit the backend at apply time and the shipped code path exercises both branches without code changes",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-7201-1",
+      "description": "createInMemoryDoStorage({backend: \"sql\"}) and createInMemoryDoStorage({backend: \"kv\"}) both round-trip put(\"k\",\"v\")->get(\"k\"), delete(\"k\") followed by get returning undefined, and list({prefix:\"p/\"}) returning a Map keyed by the prefix. driver.backend reports the chosen backend on each factory.",
+      "given": "two storage drivers, one on each backend",
+      "when": "put/get/delete/list operations are driven on each driver in turn",
+      "then": "both round-trip identically and driver.backend reports the elicited answer",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tags": [
+    "blueprint:platform-cloudflare-durable-objects"
+  ]
+}

package/rcf/user-stories/us-7301.json

@@ -0,0 +1,27 @@
+{
+  "createdAt": "2026-09-07T14:11:53.683Z",
+  "updatedAt": "2026-09-07T14:13:26.508Z",
+  "usId": "US-7301",
+  "prdId": "PRD-001",
+  "reqId": "REQ-073",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-3 alarm fires exactly once and doAlarmFired records objectName and scheduledTime",
+  "asA": "developer whose SingleCellObject schedules future work via storage.setAlarm",
+  "iWant": "the alarm() handler to fire exactly once per scheduled time and doAlarmFired to carry objectName and scheduledTime",
+  "soThat": "the applied project can observe alarm delivery through the metadata-only sink and trust the once-per-schedule contract",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-7301-1",
+      "description": "A SingleCellObject with setAlarm(100) fires alarm() once. The handler drains the persisted alarm (storage.getAlarm returns null after) and emits doAlarmFired with objectName and scheduledTime. A second alarm() call on the drained storage records scheduledTime null (no re-fire for the same schedule).",
+      "given": "a SingleCellObject with setAlarm(100)",
+      "when": "alarm() is driven once and then again after the fire",
+      "then": "the first fire emits doAlarmFired with the scheduledTime; the second fire records scheduledTime null; storage.getAlarm returns null after the first fire",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tags": [
+    "blueprint:platform-cloudflare-durable-objects"
+  ]
+}

package/rcf/user-stories/us-7401.json

@@ -0,0 +1,27 @@
+{
+  "createdAt": "2026-09-07T14:11:53.895Z",
+  "updatedAt": "2026-09-07T14:13:26.508Z",
+  "usId": "US-7401",
+  "prdId": "PRD-001",
+  "reqId": "REQ-074",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-3 hub broadcast fans out a payload from A to all connected clients within the elicited window",
+  "asA": "developer coordinating multiplayer websocket clients through one authoritative hub",
+  "iWant": "the HubObject to fan out a broadcast payload from one connected client to all connected clients within the elicited window",
+  "soThat": "the shipped hub shape delivers the coordinated-multiplayer contract without a hand-rolled broadcast layer",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-7401-1",
+      "description": "A HubObject with two accepted fake websockets A and B, when driven with webSocketMessage(A, JSON.stringify({type:\"broadcast\", payload:\"ping\"})), delivers a JSON message to both A and B whose type is \"broadcast\" and payload is \"ping\" within 500ms elapsed on the fixture clock. The persisted lastBroadcast key in storage carries the serialised outbound payload.",
+      "given": "a HubObject with two accepted fake websockets",
+      "when": "a broadcast message is sent from A",
+      "then": "both A and B receive the broadcast within 500ms; storage.get(\"lastBroadcast\") returns the serialised payload",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tags": [
+    "blueprint:platform-cloudflare-durable-objects"
+  ]
+}

package/rcf/user-stories/us-7402.json

@@ -0,0 +1,27 @@
+{
+  "createdAt": "2026-09-07T14:11:54.109Z",
+  "updatedAt": "2026-09-07T14:13:26.508Z",
+  "usId": "US-7402",
+  "prdId": "PRD-001",
+  "reqId": "REQ-074",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-3 hibernate-and-wake round-trip preserves storage and doWakeUp fires exactly once",
+  "asA": "developer whose HubObject hibernates when idle and wakes on the next message",
+  "iWant": "the wake handler to run from cold and read the same lastBroadcast key from storage the pre-hibernate state persisted",
+  "soThat": "a re-emerging client can catch up on the missed broadcast without a full re-sync",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-7402-1",
+      "description": "A HubObject that has processed a broadcast, hibernated (doHibernate emitted), and then woken (doWakeUp emitted once) resolves wake() with lastBroadcast equal to the serialised outbound payload. A second wake() resolves with alreadyAwake=true and the same lastBroadcast; no second doWakeUp fires.",
+      "given": "a HubObject with a persisted lastBroadcast that has hibernated",
+      "when": "wake() is called once, then again",
+      "then": "the first wake emits doWakeUp once and returns lastBroadcast; the second wake reports alreadyAwake without a second event",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tags": [
+    "blueprint:platform-cloudflare-durable-objects"
+  ]
+}

package/rcf/user-stories/us-7501.json

@@ -0,0 +1,27 @@
+{
+  "createdAt": "2026-09-07T14:11:54.320Z",
+  "updatedAt": "2026-09-07T14:13:26.508Z",
+  "usId": "US-7501",
+  "prdId": "PRD-001",
+  "reqId": "REQ-075",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-3 lifecycle events on the shipped path carry only allowed metadata keys",
+  "asA": "reviewer verifying the platform-cloudflare-durable-objects v1.0.0 blueprint at mechanism reach",
+  "iWant": "every lifecycle event emitted on the shipped code path to carry only the allowed metadata keys and never a forbidden key",
+  "soThat": "a logging companion can render the sink directly without a per-blueprint scrub pass",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-7501-1",
+      "description": "The event-secrecy result on the websocket-hub-broadcast probe scans every record emitted through the facade and both DO classes on the shipped path and asserts every top-level key is drawn from {event, key, size, ttl, timestamp, objectName, scheduledTime}. Under SIMULATE_PII_LEAK=true a wrapped sink forwards a synthetic body-bearing record; the probe surfaces the forbidden keys (body, ssn, userId) and returns fail on the AC-33106-1 result.",
+      "given": "a driven facade + single-cell + hub with an accumulating spy sink, and the SIMULATE_PII_LEAK switch",
+      "when": "the event-secrecy AC-33106-1 result runs on the shipped path and the simulate path",
+      "then": "the shipped path returns pass with zero forbidden keys; the simulate path surfaces the injected fields and returns fail",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tags": [
+    "blueprint:platform-cloudflare-durable-objects"
+  ]
+}

package/rcf/user-stories/us-7601.json

@@ -0,0 +1,27 @@
+{
+  "createdAt": "2026-09-07T14:11:54.530Z",
+  "updatedAt": "2026-09-07T14:13:26.508Z",
+  "usId": "US-7601",
+  "prdId": "PRD-001",
+  "reqId": "REQ-076",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-3 sole-reader-scan probe surfaces every non-facade module that dereferences env.CELL or env.HUB",
+  "asA": "reviewer enforcing the sole-reader guarantee on env.CELL and env.HUB",
+  "iWant": "the sole-reader-scan probe to walk every .mjs/.js/.ts file under the fixture applied source root and assert only src/do-facade.mjs dereferences env.CELL or env.HUB in live source",
+  "soThat": "a legacy call site or an accidental new one surfaces at self-review, not at runtime",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-7601-1",
+      "description": "The sole-reader-scan probe reads every .mjs/.js/.ts file under packages/rcf-lite/test/fixtures/cf-platform/src, strips block and line comments, matches literal env.CELL and env.HUB and reports every non-facade file with a live match as a leak. The clean-fixture scan surfaces zero leaks. Under SIMULATE_NON_FACADE_IMPORT=true a scratch leaker at $TMPDIR/t3-sole-reader-scratch is included in the scan; the scan surfaces the leak and returns fail.",
+      "given": "the cf-platform fixture applied source root, and optionally the SIMULATE_NON_FACADE_IMPORT switch",
+      "when": "the sole-reader-scan probe runs",
+      "then": "clean scan returns pass with zero leaks; simulate scan surfaces the injected leaker and returns fail",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tags": [
+    "blueprint:platform-cloudflare-durable-objects"
+  ]
+}

package/rcf/user-stories/us-7701.json

@@ -0,0 +1,27 @@
+{
+  "createdAt": "2026-09-07T14:11:54.740Z",
+  "updatedAt": "2026-09-07T14:13:26.508Z",
+  "usId": "US-7701",
+  "prdId": "PRD-001",
+  "reqId": "REQ-077",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-3 wrangler.toml commits stable DO class names on both binding blocks and a migrations tag records the mint classes",
+  "asA": "operator applying platform-cloudflare-durable-objects on a fresh Workers project",
+  "iWant": "the generated wrangler.toml to carry [[durable_objects.bindings]] blocks and a paired [[migrations]] block with a stable tag",
+  "soThat": "a future rename lands as a wrangler migration rather than a silent rewire and the DO class identity survives the mint",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-7701-1",
+      "description": "The fixture wrangler.toml carries at least two [[durable_objects.bindings]] blocks (one binding named CELL with class_name SingleCellObject; one binding named HUB with class_name HubObject) and at least one [[migrations]] block with tag \"v1\" and new_classes = [\"SingleCellObject\", \"HubObject\"]. The anatomy assertion greps the toml for each literal string and the migrations pair.",
+      "given": "the cf-platform fixture wrangler.toml",
+      "when": "the anatomy assertion greps for the four literal strings and the migrations pair",
+      "then": "every string is present and the migrations tag \"v1\" carries the two class names",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tags": [
+    "blueprint:platform-cloudflare-durable-objects"
+  ]
+}

package/rcf/user-stories/us-8001.json

@@ -0,0 +1,24 @@
+{
+  "createdAt": "2026-09-07T16:49:29.505Z",
+  "updatedAt": "2026-09-07T16:51:26.217Z",
+  "usId": "US-8001",
+  "prdId": "PRD-001",
+  "reqId": "REQ-080",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-4 JWT validator: fixture-signed JWT validates and principal reduces onto request.auth",
+  "asA": "shelf consumer applying the edge-cloudflare-access v1.0.0 blueprint on a Workers project using the cf-edge fixture",
+  "iWant": "the Cf-Access-Jwt-Assertion header validated against the Access JWKS on every request, the principal reduced into request.auth as {email, sub, groups} and the downstream handler observes 200 with the reduced principal fields",
+  "soThat": "the Worker only ever sees authenticated principals and downstream code reads a single stable seam for identity",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-8001-1",
+      "description": "The JWT validator reads Cf-Access-Jwt-Assertion, verifies against the fixture JWKS (RS256, kid rotation supported by cache), reduces the principal into request.auth as {email, sub, groups} and the downstream handler receives a 200 with the reduced principal fields exposed on request.auth.",
+      "given": "a Worker fetch handler wired with the createAccessValidator middleware and a fixture-signed JWT presented in the Cf-Access-Jwt-Assertion header",
+      "when": "the request dispatches through the validator",
+      "then": "the validator resolves, attaches {email, sub, groups} onto request.auth and delegates to the handler which returns 200 with request.auth reflected on the response body",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ]
+}

package/rcf/user-stories/us-8002.json

@@ -0,0 +1,24 @@
+{
+  "createdAt": "2026-09-07T16:49:29.726Z",
+  "updatedAt": "2026-09-07T16:51:26.402Z",
+  "usId": "US-8002",
+  "prdId": "PRD-001",
+  "reqId": "REQ-080",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-4 JWT validator: missing, expired or mis-signed JWT rejects 401 with metadata-only audit event",
+  "asA": "shelf consumer applying the edge-cloudflare-access v1.0.0 blueprint on a Workers project using the cf-edge fixture",
+  "iWant": "requests carrying a missing, expired or mis-signed JWT to reject with 401 and emit exactly one metadata-only audit event on the shipped audit sink",
+  "soThat": "unauthenticated traffic cannot reach the downstream handler and every reject is observable without leaking the token value or headers",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-8002-1",
+      "description": "The three reject subcases (missing header, expired exp, mis-signed) each return HTTP 401 and emit exactly one audit event whose keys are drawn from {email, outcome, timestamp, path} with no token substring, no header names beyond path, and no additional keys.",
+      "given": "a Worker fetch handler wired with the createAccessValidator middleware and one of the three reject subcases",
+      "when": "the request dispatches through the validator",
+      "then": "the validator resolves 401, emits one audit event with outcome in {missing, expired, invalid} and the record body carries only the four allowed keys",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ]
+}

package/rcf/user-stories/us-8003.json

@@ -0,0 +1,24 @@
+{
+  "createdAt": "2026-09-07T16:49:29.941Z",
+  "updatedAt": "2026-09-07T16:51:26.586Z",
+  "usId": "US-8003",
+  "prdId": "PRD-001",
+  "reqId": "REQ-080",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-4 JWT validator is the sole reader of the Cf-Access-Jwt-Assertion header in the applied source tree",
+  "asA": "shelf consumer applying the edge-cloudflare-access v1.0.0 blueprint on a Workers project using the cf-edge fixture",
+  "iWant": "only src/jwt-validator.mjs to dereference the Cf-Access-Jwt-Assertion header string in the applied source tree",
+  "soThat": "the validator is the single seam and a stray header read in the applied code is a defect the AST scan catches",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-8003-1",
+      "description": "The sole-reader scan walks the fixture applied source root (src/**/*.mjs), strips comments and string literals, and finds exactly one live source occurrence of the header string Cf-Access-Jwt-Assertion, in src/jwt-validator.mjs. Any other occurrence in a shipped module fails the probe.",
+      "given": "the cf-edge fixture applied source tree",
+      "when": "the sole-reader-scan probe walks src/**/*.mjs",
+      "then": "the only live-source hit for Cf-Access-Jwt-Assertion is in src/jwt-validator.mjs; SIMULATE_NON_VALIDATOR_HEADER=true injects a second hit and the probe fails",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ]
+}

package/rcf/user-stories/us-8101.json

@@ -0,0 +1,24 @@
+{
+  "createdAt": "2026-09-07T16:49:30.157Z",
+  "updatedAt": "2026-09-07T16:51:52.835Z",
+  "usId": "US-8101",
+  "prdId": "PRD-001",
+  "reqId": "REQ-081",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-4 Access application declared with elicited hostname or self-hosted-app id and elicited policy shape",
+  "asA": "operator applying the edge-cloudflare-access v1.0.0 blueprint",
+  "iWant": "the blueprint to elicit either an Access application hostname or a self-hosted-app id, plus a policy shape from the enum",
+  "soThat": "the apply record captures the exact Access application declaration the operator will issue in the Zero Trust dashboard or over the API",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-8101-1",
+      "description": "blueprint.json elicits access-application-host (kind string) or access-selfhosted-app-id (kind string, one of the two required at apply), plus access-policy-shape (kind enum, options email-domain, service-token-only, service-token-plus-email-domain, group-membership; recommended default email-domain). Applying the blueprint records the elicited values on rcf/blueprints/edge-cloudflare-access.applied.json.",
+      "given": "the blueprint.json elicits block",
+      "when": "the apply verb runs against a fixture project",
+      "then": "rcf/blueprints/edge-cloudflare-access.applied.json carries appliedCapabilities=[zeroTrustGate] and elicited values for access-application-host or access-selfhosted-app-id plus access-policy-shape",
+      "testable": true,
+      "scope": "library"
+    }
+  ]
+}

package/rcf/user-stories/us-8201.json

@@ -0,0 +1,24 @@
+{
+  "createdAt": "2026-09-07T16:49:30.372Z",
+  "updatedAt": "2026-09-07T16:51:53.022Z",
+  "usId": "US-8201",
+  "prdId": "PRD-001",
+  "reqId": "REQ-082",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-4 operator issues a Zero Trust policy via the guide's dashboard walk-through or the alternative API path",
+  "asA": "operator applying the edge-cloudflare-access v1.0.0 blueprint",
+  "iWant": "the guide to walk me through issuing the Zero Trust policy on the Cloudflare dashboard AND to document the alternative API path",
+  "soThat": "the policy issuance flow is unambiguous whether I use the dashboard or the API",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-8201-1",
+      "description": "The shipped guide/edge-cloudflare-access.md carries a section Zero Trust dashboard walk-through with numbered steps naming each screen; and a section API alternative with a curl example against https://api.cloudflare.com/client/v4/accounts/{account_id}/access/apps/{app_id}/policies; the vendor URL https://developers.cloudflare.com/cloudflare-one/policies/access/ is cited from ADR-3501 and the guide.",
+      "given": "the shipped guide file",
+      "when": "the anatomy test greps for the two section headings, the curl example and the vendor URL",
+      "then": "each string matches at least once in the file",
+      "testable": true,
+      "scope": "library"
+    }
+  ]
+}

package/rcf/user-stories/us-8301.json

@@ -0,0 +1,24 @@
+{
+  "createdAt": "2026-09-07T16:49:30.586Z",
+  "updatedAt": "2026-09-07T16:51:27.145Z",
+  "usId": "US-8301",
+  "prdId": "PRD-001",
+  "reqId": "REQ-083",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-4 audit event carries only email, outcome, timestamp and path; no token value or headers on any code path",
+  "asA": "shelf consumer applying the edge-cloudflare-access v1.0.0 blueprint on a Workers project using the cf-edge fixture",
+  "iWant": "the audit sink to receive only metadata-only records for every validate-pass and validate-reject",
+  "soThat": "the audit trail is observable without leaking the JWT, its signature bytes or any request header value",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-8301-1",
+      "description": "After 5 validate-pass and 5 validate-reject requests the audit sink holds 10 records each carrying exactly {email, outcome, timestamp, path}; the serialised JSON of every record contains no substring of the JWT (header, payload or signature), no Authorization value and no header names beyond path.",
+      "given": "the shipped createAccessValidator wired with a spy audit sink and 10 requests (5 pass, 5 reject)",
+      "when": "the requests dispatch through the validator",
+      "then": "10 sink records, each with allowed keys only, none containing forbidden substrings",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ]
+}

package/rcf/user-stories/us-8401.json

@@ -0,0 +1,24 @@
+{
+  "createdAt": "2026-09-07T16:49:30.802Z",
+  "updatedAt": "2026-09-07T16:51:27.332Z",
+  "usId": "US-8401",
+  "prdId": "PRD-001",
+  "reqId": "REQ-084",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-4 break-glass posture: an elicited bypass-service-auth token pair signs CI automation requests through the validator",
+  "asA": "operator running CI-signed automation against an Access-gated Worker",
+  "iWant": "an elicited bypass-service-auth token pair that the validator recognises and passes through as an authenticated principal",
+  "soThat": "CI can hit the gated Worker without a browser flow while every bypass leaves a distinct audit trace",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-8401-1",
+      "description": "When the request presents the elicited service-auth id and secret (as CF-Access-Client-Id and CF-Access-Client-Secret headers), the validator observes the pair, records outcome=bypass in the audit event with the same metadata-only shape, and delegates to the handler as authenticated with request.auth.email='service:'+id. Break-glass is disabled unless the elicited pair is applied.",
+      "given": "the createAccessValidator wired with an elicited bypass-service-auth pair and a request presenting the paired headers",
+      "when": "the request dispatches through the validator",
+      "then": "the handler receives request.auth with the service principal and the audit sink records outcome=bypass, with allowed keys only",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ]
+}

package/rcf/user-stories/us-8501.json

@@ -0,0 +1,24 @@
+{
+  "createdAt": "2026-09-07T16:49:31.016Z",
+  "updatedAt": "2026-09-07T16:51:27.519Z",
+  "usId": "US-8501",
+  "prdId": "PRD-001",
+  "reqId": "REQ-085",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-4 admin-console composition: the sign-in surface swaps to Access-gated when zeroTrustGate applied and falls back to security-auth-* otherwise",
+  "asA": "shelf consumer applying both edge-cloudflare-access and application-admin-console v1.1.0",
+  "iWant": "the admin-console sign-in surface to flip to Access-gated when zeroTrustGate is applied, and to fall back to the local security-auth-* surface otherwise",
+  "soThat": "the composition is deterministic and no local login form leaks into an Access-gated deployment",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-8501-1",
+      "description": "Two applied combinations are exercised on the extended admin-console fixture: with ?caps=principalDirectory,roleModel,auditLog,zeroTrustGate the sign-in surface renders [data-surface=access-gated] and no [data-surface=local-login] is present; with ?caps=principalDirectory,roleModel,auditLog the sign-in surface renders [data-surface=local-login] and no [data-surface=access-gated] is present. Both combinations exercise the shipped pack check AC-21815-1.",
+      "given": "the admin-console pack fixture with the two caps combinations",
+      "when": "the pack runs against each combination",
+      "then": "AC-21815-1 fires on the gated combination and passes; the existing v1.0.0 surface renders on the non-gated combination and its own check passes",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ]
+}

package/rcf/user-stories/us-8502.json

@@ -0,0 +1,24 @@
+{
+  "createdAt": "2026-09-07T16:49:31.234Z",
+  "updatedAt": "2026-09-07T16:51:27.703Z",
+  "usId": "US-8502",
+  "prdId": "PRD-001",
+  "reqId": "REQ-085",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-4 real-account gated URL: a request against a scheduled Access-configured hostname lands the Access UI",
+  "asA": "HQ operator running the real-account gated-URL smoke against a scheduled Access-configured hostname",
+  "iWant": "the probe to fire against the hostname when the env vars are present and record accountBoundSkipped when not",
+  "soThat": "the mechanism-reach claim is proven on a real Cloudflare Access instance without ever failing the shelf gate on the absence of an account",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-8502-1",
+      "description": "With CI_HAS_CLOUDFLARE_ACCOUNT=true and CF_ACCESS_HOST=<hostname>, a plain fetch against https://<hostname>/ follows the redirect chain and terminates at an https://<team>.cloudflareaccess.com/ URL (the Access UI). Without either env var the probe records accountBoundSkipped=true and aggregateVerdict=pass per spec section 3.5.",
+      "given": "the run-real-account-gated-url.mjs probe shim and the two env vars",
+      "when": "the probe runs",
+      "then": "in the CI-with-account path the redirect chain reports cloudflareaccess.com as terminal; in the without-env path accountBoundSkipped is true",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ]
+}

package/rcf/user-stories/us-8601.json

@@ -0,0 +1,24 @@
+{
+  "createdAt": "2026-09-07T16:49:31.448Z",
+  "updatedAt": "2026-09-07T16:51:53.213Z",
+  "usId": "US-8601",
+  "prdId": "PRD-001",
+  "reqId": "REQ-086",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-4 admin-console v1.1.0: Access-gated sign-in surface with no local login form and principal reads from request.auth",
+  "asA": "shelf consumer applying application-admin-console v1.1.0 with zeroTrustGate in the applied capability set",
+  "iWant": "the sign-in surface to render as Access-gated with no local login form and to read the principal from request.auth",
+  "soThat": "the admin console composes with edge-cloudflare-access at the sign-in seam and never re-collects credentials in an Access-gated deployment",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-8601-1",
+      "description": "The repo-chain AC for the admin-console v1.1.0 Access-gated sign-in surface. The shipped pack check on application-admin-console.pack.mjs (id AC-21815-1 in the blueprint's own band) asserts that when application-admin-console v1.1.0 is applied with zeroTrustGate in appliedCapabilities, GET /admin/sign-in renders a region with [data-surface=access-gated], no [data-surface=local-login] region is present, and a [data-role=principal-read] element renders the principal email read from request.auth.",
+      "given": "the extended admin-console pack fixture on ?caps=principalDirectory,roleModel,auditLog,zeroTrustGate",
+      "when": "the pack drives GET /admin/sign-in",
+      "then": "the DOM carries [data-surface=access-gated], no [data-surface=local-login], and a [data-role=principal-read] with the request.auth email",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ]
+}

package/rcf/user-stories/us-8602.json

@@ -0,0 +1,24 @@
+{
+  "createdAt": "2026-09-07T16:49:31.662Z",
+  "updatedAt": "2026-09-07T16:51:28.075Z",
+  "usId": "US-8602",
+  "prdId": "PRD-001",
+  "reqId": "REQ-086",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-4 admin-console v1.1.0: falls back to security-auth-* sign-in surface when zeroTrustGate absent",
+  "asA": "shelf consumer applying application-admin-console v1.1.0 WITHOUT zeroTrustGate in the applied capability set",
+  "iWant": "the sign-in surface to render as the local security-auth-* surface with no Access-gated region",
+  "soThat": "the v1.1.0 admin-console remains backward-compatible with every v1.0.0 deployment that never adopted Access",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-8602-1",
+      "description": "When application-admin-console v1.1.0 is applied without zeroTrustGate in appliedCapabilities, GET /admin/sign-in renders a region with [data-surface=local-login] and no [data-surface=access-gated] region is present.",
+      "given": "the extended admin-console pack fixture on ?caps=principalDirectory,roleModel,auditLog",
+      "when": "the pack drives GET /admin/sign-in",
+      "then": "the DOM carries [data-surface=local-login] and no [data-surface=access-gated]",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ]
+}

package/rcf/user-stories/us-9001.json

@@ -0,0 +1,27 @@
+{
+  "createdAt": "2026-09-07T19:54:01.850Z",
+  "updatedAt": "2026-09-07T19:56:38.973Z",
+  "asA": "shelf consumer applying the edge-cloudflare-turnstile v1.0.0 blueprint on a Workers project using the probe-pack-edge-cloudflare-turnstile fixture",
+  "iWant": "the Turnstile widget to mount on my public form with the elicited TURNSTILE_SITEKEY, to inject only Cloudflare Turnstile JS (no other third-party script), and to populate the hidden Cf-Turnstile-Response token field on submit",
+  "soThat": "every submit that reaches my server carries a Turnstile response my server-side verifier can check",
+  "usId": "US-9001",
+  "prdId": "PRD-001",
+  "reqId": "REQ-090",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-5 widget mount: elicited sitekey renders Turnstile widget with token populated on submit",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-9001-1",
+      "description": "When the fixture page loads with the always-pass test sitekey, the Turnstile widget mounts and an iframe is present whose src origin is https://challenges.cloudflare.com; the page loads no third-party script from any other origin; on submit the form payload carries a non-empty Cf-Turnstile-Response value.",
+      "given": "the pack fixture form loaded with default sitekey pass and the pinned always-pass test sitekey",
+      "when": "the widget renders and the operator submits",
+      "then": "the Turnstile widget is mounted, its iframe origin is Cloudflare Turnstile only, and the submit payload contains the Cf-Turnstile-Response token",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-3601-edge-cloudflare-turnstile-widget-mount"
+  ]
+}

package/rcf/user-stories/us-9002.json

@@ -0,0 +1,27 @@
+{
+  "createdAt": "2026-09-07T19:56:35.026Z",
+  "updatedAt": "2026-09-07T19:56:39.157Z",
+  "asA": "reviewer auditing the applied Workers project source for secret hygiene",
+  "iWant": "the TURNSTILE_SECRET to be read through the elicited config or applied secrets facade, and to see no plain-text secret literal in the fixture source",
+  "soThat": "the Turnstile secret is never committed to the applying project source tree",
+  "usId": "US-9002",
+  "prdId": "PRD-001",
+  "reqId": "REQ-090",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-5 secret shape: TURNSTILE_SECRET is read only via the applied secrets facade and never inlined in fixture source",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-9002-1",
+      "description": "A source-tree AST scan of the pack fixture (packages/rcf-lite/test/fixtures/probe-pack-edge-cloudflare-turnstile) asserts that TURNSTILE_SECRET is dereferenced only via process.env or an env-shaped facade and that no plain-string secret literal appears in the fixture source. The Node probe secret-shape-scan implements the assertion and exits 0 on the fixture.",
+      "given": "the shipped pack fixture with the pinned test secret sourced from environment",
+      "when": "the source-tree AST scan runs over the fixture",
+      "then": "the scan finds only env-shaped reads for TURNSTILE_SECRET and reports no plain-string secret literal",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-3602-edge-cloudflare-turnstile-server-verifier"
+  ]
+}

package/rcf/user-stories/us-9101.json

@@ -0,0 +1,27 @@
+{
+  "createdAt": "2026-09-07T19:56:35.429Z",
+  "updatedAt": "2026-09-07T19:56:39.347Z",
+  "asA": "shelf consumer whose Worker verifies Turnstile tokens through the shipped verifier",
+  "iWant": "a POST to challenges.cloudflare.com/turnstile/v0/siteverify with the pinned always-pass secret and any response token to return success true and my handler to respond 200",
+  "soThat": "the Turnstile-verified path is exercised end-to-end against the real Cloudflare endpoint",
+  "usId": "US-9101",
+  "prdId": "PRD-001",
+  "reqId": "REQ-091",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-5 server-side siteverify pass: the always-pass Turnstile secret returns success:true and the handler proceeds with 200",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-9101-1",
+      "description": "A live POST to https://challenges.cloudflare.com/turnstile/v0/siteverify with secret=1x0000000000000000000000000000000AA and any response token returns success:true; the pack-fixture /api/submit handler proceeds with 200. The Node siteverify-fixture probe drives the live endpoint and asserts success:true.",
+      "given": "the pack fixture running on 127.0.0.1 with the pinned always-pass secret in the environment",
+      "when": "a form submit hits /api/submit carrying the always-pass response token",
+      "then": "the server-side POST to Cloudflare returns success:true and the handler responds 200",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-3602-edge-cloudflare-turnstile-server-verifier"
+  ]
+}

package/rcf/user-stories/us-9102.json

@@ -0,0 +1,27 @@
+{
+  "createdAt": "2026-09-07T19:56:35.831Z",
+  "updatedAt": "2026-09-07T19:56:39.532Z",
+  "asA": "shelf consumer whose Worker fails safe on any Turnstile verification refusal",
+  "iWant": "a POST to siteverify with the pinned always-fail secret to return success false, the handler to reject with 400, and every event record to carry only sitekeyHash, outcome and timestamp",
+  "soThat": "the fail branch never leaks the secret or the response token into observability",
+  "usId": "US-9102",
+  "prdId": "PRD-001",
+  "reqId": "REQ-091",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-5 server-side siteverify fail: the always-fail Turnstile secret returns success:false, the handler rejects 400, and event records carry no token or secret",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-9102-1",
+      "description": "A live POST to siteverify with secret=2x0000000000000000000000000000000AA returns success:false; the pack-fixture /api/submit handler rejects with 400 whose body carries the error-codes value, not the sitekey. The Node event-secrecy probe asserts that every event record captured on submit carries {sitekeyHash, outcome, timestamp} keys only and does not carry the token or the secret string.",
+      "given": "the pack fixture running with the pinned always-fail secret in the environment and event-secrecy probe attached",
+      "when": "a form submit hits /api/submit and the verifier calls siteverify",
+      "then": "siteverify returns success:false, the handler responds 400 with an error-codes body, and every event record carries only sitekeyHash, outcome and timestamp",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-3602-edge-cloudflare-turnstile-server-verifier"
+  ]
+}