rcf-lite 0.22.0 → 0.24.0

package/blueprints/edge-cloudflare-rate-limiting/blueprint.json

@@ -0,0 +1,174 @@
+{
+  "slug": "edge-cloudflare-rate-limiting",
+  "version": "1.0.0",
+  "category": "edge",
+  "capabilities": [
+    "edgeRateLimit"
+  ],
+  "suggestedCompanions": [
+    {
+      "role": "logging",
+      "reason": "Every drift-audit report and every rate-limit event writes through the applied logger; a logging companion supplies the sink factory."
+    },
+    {
+      "role": "errorHandling",
+      "reason": "A drift-audit failure, a Cloudflare API error, a manifest schema violation constructs an internal error record; an error-handling companion supplies the record factory and the boundary."
+    },
+    {
+      "role": "secretsManagement",
+      "reason": "The Cloudflare API token that the drift-audit runner and any wrangler-based apply flow use is stored via the applied secretsManagement companion; the elicited zone id may also be projected through the vault when the operator wants a single source of truth."
+    }
+  ],
+  "elicits": [
+    {
+      "id": "rate-limit-rules-dir",
+      "prompt": "Directory the applying project commits its rate-limit rule manifest files into. One file per rule per ADR-3703. The manifest is source-of-truth; the operator applies it via wrangler or the Cloudflare dashboard per REQ-002.",
+      "kind": "string",
+      "default": "cloudflare/rate-limits"
+    },
+    {
+      "id": "rate-limit-zone-id",
+      "prompt": "Cloudflare zone id the rules apply to. Never inline in a rule manifest; store via the applied secretsManagement companion and reference at apply time. Empty string leaves the zone id unresolved (the drift audit and any wrangler flow surface the omission).",
+      "kind": "string",
+      "default": ""
+    },
+    {
+      "id": "rate-limit-management-surface",
+      "prompt": "Operator-facing management surface per REQ-002 and TAC-3702. wrangler names the command flow the guide walks through; dashboard names the Cloudflare dashboard flow; both records both flows and lets the operator pick per rule.",
+      "kind": "enum",
+      "options": [
+        "wrangler",
+        "dashboard",
+        "both"
+      ],
+      "default": "both"
+    },
+    {
+      "id": "rate-limit-drift-audit-cadence",
+      "prompt": "Drift-audit cadence per ADR-3704. off disables the runner; daily runs it every 24 hours; hourly runs it every hour. daily is the recommended default.",
+      "kind": "enum",
+      "options": [
+        "off",
+        "daily",
+        "hourly"
+      ],
+      "default": "daily"
+    }
+  ],
+  "contributions": [
+    {
+      "id": "edge-cloudflare-rate-limiting-REQ-001",
+      "kind": "req",
+      "path": "requirements/edge-cloudflare-rate-limiting-req-001.json"
+    },
+    {
+      "id": "edge-cloudflare-rate-limiting-REQ-002",
+      "kind": "req",
+      "path": "requirements/edge-cloudflare-rate-limiting-req-002.json"
+    },
+    {
+      "id": "edge-cloudflare-rate-limiting-REQ-003",
+      "kind": "req",
+      "path": "requirements/edge-cloudflare-rate-limiting-req-003.json"
+    },
+    {
+      "id": "edge-cloudflare-rate-limiting-REQ-004",
+      "kind": "req",
+      "path": "requirements/edge-cloudflare-rate-limiting-req-004.json"
+    },
+    {
+      "id": "edge-cloudflare-rate-limiting-REQ-005",
+      "kind": "req",
+      "path": "requirements/edge-cloudflare-rate-limiting-req-005.json"
+    },
+    {
+      "id": "edge-cloudflare-rate-limiting-US-36101",
+      "kind": "us",
+      "path": "user-stories/edge-cloudflare-rate-limiting-us-36101.json"
+    },
+    {
+      "id": "edge-cloudflare-rate-limiting-US-36102",
+      "kind": "us",
+      "path": "user-stories/edge-cloudflare-rate-limiting-us-36102.json"
+    },
+    {
+      "id": "edge-cloudflare-rate-limiting-US-36103",
+      "kind": "us",
+      "path": "user-stories/edge-cloudflare-rate-limiting-us-36103.json"
+    },
+    {
+      "id": "edge-cloudflare-rate-limiting-US-36104",
+      "kind": "us",
+      "path": "user-stories/edge-cloudflare-rate-limiting-us-36104.json"
+    },
+    {
+      "id": "edge-cloudflare-rate-limiting-US-36105",
+      "kind": "us",
+      "path": "user-stories/edge-cloudflare-rate-limiting-us-36105.json"
+    },
+    {
+      "id": "edge-cloudflare-rate-limiting-US-36106",
+      "kind": "us",
+      "path": "user-stories/edge-cloudflare-rate-limiting-us-36106.json"
+    },
+    {
+      "id": "edge-cloudflare-rate-limiting-US-36107",
+      "kind": "us",
+      "path": "user-stories/edge-cloudflare-rate-limiting-us-36107.json"
+    },
+    {
+      "id": "edge-cloudflare-rate-limiting-US-36108",
+      "kind": "us",
+      "path": "user-stories/edge-cloudflare-rate-limiting-us-36108.json"
+    },
+    {
+      "id": "TAC-3701-edge-cloudflare-rate-limiting-manifest-schema",
+      "kind": "tac",
+      "path": "tacs/tac-3701-edge-cloudflare-rate-limiting-manifest-schema.json"
+    },
+    {
+      "id": "TAC-3702-edge-cloudflare-rate-limiting-management-surface-doc",
+      "kind": "tac",
+      "path": "tacs/tac-3702-edge-cloudflare-rate-limiting-management-surface-doc.json"
+    },
+    {
+      "id": "TAC-3703-edge-cloudflare-rate-limiting-drift-audit-runner",
+      "kind": "tac",
+      "path": "tacs/tac-3703-edge-cloudflare-rate-limiting-drift-audit-runner.json"
+    },
+    {
+      "id": "ADR-3701-edge-cloudflare-rate-limiting-throttle-contract",
+      "kind": "adr",
+      "path": "adrs/adr-3701-edge-cloudflare-rate-limiting-throttle-contract.json",
+      "scope": "global",
+      "topic": "edgeThrottleContract",
+      "recommendedDefault": true,
+      "elicited": false,
+      "standardsTraceClause": "Cloudflare WAF rate-limiting rules documented shape"
+    },
+    {
+      "id": "ADR-3702-edge-cloudflare-rate-limiting-layering",
+      "kind": "adr",
+      "path": "adrs/adr-3702-edge-cloudflare-rate-limiting-layering.json",
+      "recommendedDefault": true,
+      "elicited": false,
+      "standardsTraceClause": "generic enterprise practice"
+    },
+    {
+      "id": "ADR-3703-edge-cloudflare-rate-limiting-manifest-shape",
+      "kind": "adr",
+      "path": "adrs/adr-3703-edge-cloudflare-rate-limiting-manifest-shape.json",
+      "recommendedDefault": true,
+      "elicited": false,
+      "standardsTraceClause": "generic enterprise practice"
+    },
+    {
+      "id": "ADR-3704-edge-cloudflare-rate-limiting-drift-audit-cadence",
+      "kind": "adr",
+      "path": "adrs/adr-3704-edge-cloudflare-rate-limiting-drift-audit-cadence.json",
+      "recommendedDefault": true,
+      "elicited": true,
+      "standardsTraceClause": "generic enterprise practice"
+    }
+  ]
+}

package/blueprints/edge-cloudflare-rate-limiting/contributions/adrs/adr-3701-edge-cloudflare-rate-limiting-throttle-contract.json

@@ -0,0 +1,14 @@
+{
+  "adrId": "ADR-3701-edge-cloudflare-rate-limiting-throttle-contract",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "accepted",
+  "title": "Edge throttle contract: Cloudflare WAF rate-limiting rules as the shipped shape (scope global, new topic edgeThrottleContract)",
+  "context": "An applying Workers project that fronts a public surface needs a zone-level guard that refuses over-threshold bursts at the CF edge before they reach the origin Worker. Cloudflare's WAF rate-limiting rules provide the native answer: a set of rules on the zone, each with expression, threshold, period, characteristics, action and duration per https://developers.cloudflare.com/waf/rate-limiting-rules/. Every applied Worker needs one project-wide answer to the edgeThrottleContract topic; a future non-Cloudflare edge-throttle sibling (Fastly rate-limits, Vercel edge config throttles) would conflict on the same topic by design.",
+  "decision": "The shipped v1.0.0 default is Cloudflare WAF rate-limiting rules as the zone-level edge throttle. The rule shape (id, expression, threshold, period, characteristics, action, duration) matches the Cloudflare-documented shape per https://developers.cloudflare.com/waf/rate-limiting-rules/. The edgeThrottleContract topic scope is global on this blueprint; the topic string is edgeThrottleContract (lower camel case, one concept per topic, no version suffix). A future non-Cloudflare adapter contributes the same topic string with a different answer, forcing a DELIBERATE conflict the operator resolves with a project-level ADR. Standards trace clause: Cloudflare WAF rate-limiting rules documented shape.",
+  "consequences": "The applying project inherits Cloudflare's documented rule shape and the platform-imposed limits on rules per zone. The rule state lives on the Cloudflare account, not in the project git tree; the local manifest under cloudflare/rate-limits/ is the source of truth an operator applies via the wrangler or dashboard flow per REQ-002. Drift risk is addressed via ADR-3704 (drift-audit cadence) and TAC-3703 (drift-audit runner). Consumers deploying to a non-Cloudflare edge reach for a sibling adapter blueprint that would land as a v1.x minor on this shelf.",
+  "alternativesConsidered": [],
+  "createdAt": "2026-09-07T22:00:00.000Z",
+  "updatedAt": "2026-09-07T22:00:00.000Z"
+}

package/blueprints/edge-cloudflare-rate-limiting/contributions/adrs/adr-3702-edge-cloudflare-rate-limiting-layering.json

@@ -0,0 +1,14 @@
+{
+  "adrId": "ADR-3702-edge-cloudflare-rate-limiting-layering",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "accepted",
+  "title": "Layering with security-auth-magic-link: zone rate rule sits OVER the per-email application rule",
+  "context": "The security-auth-magic-link blueprint ships a per-email per-minute application-level rate limiter on the mint surface. The edge-cloudflare-rate-limiting blueprint ships a zone-level rate rule characterised by IP-per-URL at the CF edge. Applying both blueprints without an explicit layering ADR would leave two rate rules whose characteristic sets an operator could easily mistake for overlapping.",
+  "decision": "When both blueprints are applied, the zone-level rate rule sits at the CF edge and refuses the (N+1)th request for the elicited duration before it reaches the origin Worker; the security-auth-magic-link per-email application limiter continues to run on requests that pass the edge gate, applying per-email per-minute limits at the mint-surface. The two rules operate on different characteristic sets (IP-per-URL at the zone, email at the application) and are additive, not overlapping. recommendedDefault: true. Standards trace clause: generic enterprise practice.",
+  "consequences": "The composition is documented in the blueprint guide with a copy-paste example (AC-36105-1). The applied recorder records both blueprints so the operator sees the two-rule shape at apply time; a subsequent change to either rule's characteristic that would drift the composition into overlap is caught in the drift-audit runner (TAC-3703).",
+  "alternativesConsidered": [],
+  "createdAt": "2026-09-07T22:00:00.000Z",
+  "updatedAt": "2026-09-07T22:00:00.000Z"
+}

package/blueprints/edge-cloudflare-rate-limiting/contributions/adrs/adr-3703-edge-cloudflare-rate-limiting-manifest-shape.json

@@ -0,0 +1,14 @@
+{
+  "adrId": "ADR-3703-edge-cloudflare-rate-limiting-manifest-shape",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "accepted",
+  "title": "Manifest lives at cloudflare/rate-limits/, one JSON file per rule; the operator applies via wrangler or dashboard, not via a committed script",
+  "context": "The rule set could be committed as a wrangler-shape script, a bespoke apply tool, a single manifest file, or one file per rule. The single-file shape hides diff signal when one rule changes; the committed script couples the source of truth to a specific tool. The one-file-per-rule shape keeps a rule change to one file diff, makes review straightforward, and leaves the apply flow to the operator's choice of wrangler or dashboard.",
+  "decision": "The manifest lives at the elicited rate-limit-rules-dir (default cloudflare/rate-limits/), with one JSON file per rule. The blueprint ships no committed script that writes rules to the live zone; the operator applies through the documented wrangler or dashboard flow per REQ-002 and TAC-3702. recommendedDefault: true. Standards trace clause: generic enterprise practice.",
+  "consequences": "One-file-per-rule keeps each rule diff scoped; the operator can review a rule change in isolation. No committed apply script means the shipped blueprint does not couple to a specific tool version and does not require a Cloudflare API token at build time. Operator applies the manifest at a cadence they set; drift risk is addressed via ADR-3704 and TAC-3703.",
+  "alternativesConsidered": [],
+  "createdAt": "2026-09-07T22:00:00.000Z",
+  "updatedAt": "2026-09-07T22:00:00.000Z"
+}

package/blueprints/edge-cloudflare-rate-limiting/contributions/adrs/adr-3704-edge-cloudflare-rate-limiting-drift-audit-cadence.json

@@ -0,0 +1,14 @@
+{
+  "adrId": "ADR-3704-edge-cloudflare-rate-limiting-drift-audit-cadence",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "accepted",
+  "title": "Drift-audit cadence: off, daily or hourly (elicited; recommendedDefault daily)",
+  "context": "Rate-limit rules live on the Cloudflare account, not in the project git tree. An operator that changes a rule on the dashboard without a matching manifest update leaves the source of truth behind; a manifest edit that is not applied to the live zone leaves the live behaviour behind. Both directions of drift are runtime-observable but only if the applying project runs the drift-audit runner at a cadence.",
+  "decision": "The drift-audit cadence is elicited (rate-limit-drift-audit-cadence) with three options: off (disables the runner), daily (24-hour cadence), hourly (60-minute cadence). recommendedDefault: daily. elicited: true. Standards trace clause: generic enterprise practice.",
+  "consequences": "daily is the safe default for the typical operator (a manifest change that misses the live zone is surfaced within 24 hours through the applied logging companion's audit sink). hourly is the safe default for a high-cadence operation (the applying project makes rule changes multiple times a week and wants a same-day signal). off is safe only when the operator has an alternative drift-check discipline (a manual review after every change); the elicit prompts for the operator's choice at apply time.",
+  "alternativesConsidered": [],
+  "createdAt": "2026-09-07T22:00:00.000Z",
+  "updatedAt": "2026-09-07T22:00:00.000Z"
+}

package/blueprints/edge-cloudflare-rate-limiting/contributions/probes/event-secrecy.mjs

@@ -0,0 +1,104 @@
+// Probe: drift-audit event secrecy.
+//
+// anchorAcId: AC-36107-1. accountBound: false.
+//
+// Drives the shipped drift-audit runner realisation
+// (packages/rcf-lite/test/fixtures/cf-edge/src/drift-audit-runner.mjs)
+// with a synthetic manifest loader and a fake fetch that returns a
+// live-zone response with one mismatched rule. Asserts every record
+// on the sink carries only {ruleId, clientIpHash, outcome, timestamp,
+// diff} keys and NO full IPv4 or IPv6 address, NO body key, NO user
+// agent key. Under SIMULATE_EVENT_LEAK_IP=true the runner injects a
+// full client IP into the outcome so the probe surfaces the leak.
+
+import { FIXTURE_DIR } from './probe-utils.mjs';
+
+export const anchorAcId = 'AC-36107-1';
+export const accountBound = false;
+
+const IPV4 = /\b(?:25[0-5]|2[0-4]\d|[01]?\d?\d)(?:\.(?:25[0-5]|2[0-4]\d|[01]?\d?\d)){3}\b/;
+const IPV6 = /\b(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}\b/;
+const ALLOWED_KEYS = new Set(['ruleId', 'clientIpHash', 'outcome', 'timestamp', 'diff']);
+const FORBIDDEN_KEYS = new Set(['body', 'userAgent', 'user-agent', 'clientIp', 'ip', 'sourceIp']);
+
+function containsIp(text) {
+  if (typeof text !== 'string') return null;
+  const v4 = text.match(IPV4);
+  if (v4) return v4[0];
+  const v6 = text.match(IPV6);
+  if (v6) return v6[0];
+  return null;
+}
+
+export default async function runProbe() {
+  const runnerMod = await import(`${FIXTURE_DIR}/src/drift-audit-runner.mjs`);
+  const manifestRule = {
+    id: 'public-api-per-ip',
+    expression: '(http.request.uri.path matches "^/api/")',
+    threshold: 60,
+    period: 60,
+    characteristics: ['ip.src', 'cf.colo.id'],
+    action: 'block',
+    duration: 60,
+  };
+  const liveRule = { ...manifestRule, threshold: 90 };
+  const captured = [];
+  const eventSink = (record) => captured.push(record);
+  const fakeFetch = async () => ({
+    ok: true,
+    status: 200,
+    async json() { return { result: [liveRule] }; },
+  });
+  const runner = runnerMod.createDriftAuditRunner({
+    env: {
+      CF_ZONE_ID: 'fixture-zone-id',
+      SIMULATE_EVENT_LEAK_IP: process.env.SIMULATE_EVENT_LEAK_IP,
+    },
+    eventSink,
+    fetch: fakeFetch,
+    clock: () => '2026-09-07T22:00:00.000Z',
+    cadence: 'daily',
+    manifestLoader: async () => [manifestRule],
+  });
+  const report = await runner.runOnce();
+  const results = [];
+  if (captured.length === 0) {
+    results.push({ anchorAcId: 'AC-36107-1', verdict: 'fail', detail: 'drift-audit runner produced zero records; expected one for the threshold drift.' });
+    return { results };
+  }
+  let ipLeak = null;
+  let keyLeak = null;
+  for (const rec of captured) {
+    for (const k of Object.keys(rec)) {
+      if (FORBIDDEN_KEYS.has(k)) keyLeak = k;
+      if (!ALLOWED_KEYS.has(k)) keyLeak = keyLeak || `unexpected-key:${k}`;
+    }
+    for (const v of Object.values(rec)) {
+      if (typeof v === 'string') {
+        const hit = containsIp(v);
+        if (hit) ipLeak = hit;
+      }
+    }
+  }
+  if (keyLeak) {
+    results.push({ anchorAcId: 'AC-36107-1', verdict: 'fail', detail: `drift-audit record carries a forbidden or unexpected key: ${keyLeak}` });
+  }
+  if (ipLeak) {
+    results.push({ anchorAcId: 'AC-36107-1', verdict: 'fail', detail: `drift-audit record leaked a full IP address in a string field: ${ipLeak}` });
+  }
+  if (results.length === 0) {
+    results.push({
+      anchorAcId: 'AC-36107-1',
+      verdict: 'pass',
+      detail: `drift-audit runner produced ${captured.length} record(s); every record carries only ${[...ALLOWED_KEYS].join(', ')} and no full IP, body or user-agent field appears.`,
+    });
+  }
+  return {
+    results,
+    extra: {
+      recordCount: captured.length,
+      driftCount: report.driftCount,
+      allowedKeys: [...ALLOWED_KEYS],
+    },
+  };
+}

package/blueprints/edge-cloudflare-rate-limiting/contributions/probes/manifest-presence.mjs

@@ -0,0 +1,95 @@
+// Probe: rate-limit manifest presence.
+//
+// anchorAcId: AC-36101-1 (also surfaces AC-36108-1's missing-file
+// negative through SIMULATE_MANIFEST_MISSING). accountBound: false.
+//
+// Reads the cf-edge fixture manifest directory (cloudflare/rate-limits/),
+// asserts:
+//   - at least one JSON file is present under the directory.
+//   - every file parses as JSON.
+//   - every file carries the seven required Cloudflare WAF rate-limiting
+//     rules fields (id, expression, threshold, period, characteristics,
+//     action, duration).
+//   - no file body carries a plaintext bearer token, private key or
+//     inline CF_API_TOKEN reference.
+//
+// Under SIMULATE_MANIFEST_MISSING=true the probe treats the first
+// manifest file as absent and returns aggregateVerdict: fail with
+// the missing basename named in the detail (AC-36108-1).
+
+import { readManifestFiles, scanForPlaintextSecrets, REQUIRED_FIELDS } from './probe-utils.mjs';
+
+export const anchorAcId = 'AC-36101-1';
+export const accountBound = false;
+
+export default async function runProbe() {
+  const { present, entries, files = [], hiddenBySimulate = [] } = await readManifestFiles();
+  const results = [];
+  if (!present) {
+    results.push({
+      anchorAcId: 'AC-36101-1',
+      verdict: 'fail',
+      detail: 'manifest directory holds zero JSON files; cf-edge fixture must ship at least one rule file under cloudflare/rate-limits/.',
+    });
+    return { results };
+  }
+  if (hiddenBySimulate.length > 0) {
+    results.push({
+      anchorAcId: 'AC-36108-1',
+      verdict: 'fail',
+      detail: `manifest file missing: ${hiddenBySimulate.join(', ')} (SIMULATE_MANIFEST_MISSING=true).`,
+    });
+    return { results };
+  }
+  let missingFieldCount = 0;
+  let plaintextCount = 0;
+  const fileFindings = [];
+  for (const f of files) {
+    let doc;
+    try {
+      doc = JSON.parse(f.text);
+    } catch (err) {
+      results.push({
+        anchorAcId: 'AC-36101-1',
+        verdict: 'fail',
+        detail: `manifest file ${f.name} does not parse as JSON: ${err.message}`,
+      });
+      continue;
+    }
+    const missing = REQUIRED_FIELDS.filter((k) => !(k in doc));
+    if (missing.length > 0) {
+      missingFieldCount += 1;
+      results.push({
+        anchorAcId: 'AC-36101-1',
+        verdict: 'fail',
+        detail: `manifest file ${f.name} missing required fields: ${missing.join(', ')}`,
+      });
+    }
+    const hits = scanForPlaintextSecrets(f.text);
+    if (hits.length > 0) {
+      plaintextCount += 1;
+      results.push({
+        anchorAcId: 'AC-36101-1',
+        verdict: 'fail',
+        detail: `manifest file ${f.name} carries plaintext secret pattern(s): ${hits.join(', ')}`,
+      });
+    }
+    fileFindings.push({ name: f.name, ruleId: doc.id ?? null });
+  }
+  if (results.length === 0) {
+    results.push({
+      anchorAcId: 'AC-36101-1',
+      verdict: 'pass',
+      detail: `${files.length} manifest file(s) inspected; every file carries the ${REQUIRED_FIELDS.length} required fields and no plaintext secret pattern was found.`,
+    });
+  }
+  return {
+    results,
+    extra: {
+      manifestFileCount: files.length,
+      manifestFiles: fileFindings,
+      missingFieldFileCount: missingFieldCount,
+      plaintextHitFileCount: plaintextCount,
+    },
+  };
+}

package/blueprints/edge-cloudflare-rate-limiting/contributions/probes/manifest-schema-validate.mjs

@@ -0,0 +1,130 @@
+// Probe: rate-limit manifest schema-validate.
+//
+// anchorAcId: AC-36106-1. accountBound: false.
+//
+// Reads the cf-edge fixture manifest directory, loads the shipped
+// JSON Schema (contributions/schemas/rate-limit-rule.schema.json,
+// draft-07) and validates every manifest file against it. A minimal
+// dependency-free validator covers the shape the schema commits to:
+// required-fields, type-per-field, integer-minimum, string-min-length,
+// non-empty-array and additionalProperties: false.
+//
+// Under SIMULATE_SCHEMA_INVALID=true the probe writes a scratch
+// manifest file that omits the threshold field so validation fails
+// with the offending field named in the detail.
+
+import { readdir, readFile, writeFile, unlink, mkdir } from 'node:fs/promises';
+import { join } from 'node:path';
+import { MANIFEST_DIR, REQUIRED_FIELDS, ACTION_ENUM, loadSchema } from './probe-utils.mjs';
+
+export const anchorAcId = 'AC-36106-1';
+export const accountBound = false;
+
+function validateDoc(doc, schema, filename) {
+  const failures = [];
+  if (typeof doc !== 'object' || doc === null || Array.isArray(doc)) {
+    failures.push(`${filename}: root is not a JSON object`);
+    return failures;
+  }
+  for (const required of schema.required) {
+    if (!(required in doc)) failures.push(`${filename}: missing required field ${required}`);
+  }
+  const props = schema.properties || {};
+  const allowed = new Set(Object.keys(props));
+  if (schema.additionalProperties === false) {
+    for (const key of Object.keys(doc)) {
+      if (!allowed.has(key)) failures.push(`${filename}: additional property not permitted: ${key}`);
+    }
+  }
+  for (const [key, def] of Object.entries(props)) {
+    if (!(key in doc)) continue;
+    const v = doc[key];
+    if (def.type === 'string') {
+      if (typeof v !== 'string') { failures.push(`${filename}: ${key} is not a string`); continue; }
+      if (typeof def.minLength === 'number' && v.length < def.minLength) failures.push(`${filename}: ${key} shorter than minLength ${def.minLength}`);
+      if (Array.isArray(def.enum) && !def.enum.includes(v)) failures.push(`${filename}: ${key} value ${JSON.stringify(v)} not in enum ${JSON.stringify(def.enum)}`);
+    } else if (def.type === 'integer') {
+      if (!Number.isInteger(v)) { failures.push(`${filename}: ${key} is not an integer`); continue; }
+      if (typeof def.minimum === 'number' && v < def.minimum) failures.push(`${filename}: ${key} value ${v} below minimum ${def.minimum}`);
+    } else if (def.type === 'array') {
+      if (!Array.isArray(v)) { failures.push(`${filename}: ${key} is not an array`); continue; }
+      if (typeof def.minItems === 'number' && v.length < def.minItems) failures.push(`${filename}: ${key} array shorter than minItems ${def.minItems}`);
+      if (def.items && def.items.type === 'string') {
+        v.forEach((item, i) => {
+          if (typeof item !== 'string') failures.push(`${filename}: ${key}[${i}] is not a string`);
+          else if (typeof def.items.minLength === 'number' && item.length < def.items.minLength) failures.push(`${filename}: ${key}[${i}] shorter than minLength ${def.items.minLength}`);
+        });
+      }
+    }
+  }
+  return failures;
+}
+
+export default async function runProbe() {
+  const schema = await loadSchema();
+  const simulateInvalid = process.env.SIMULATE_SCHEMA_INVALID === 'true';
+  const results = [];
+  const fileFindings = [];
+  let scratchPath = null;
+  try {
+    if (simulateInvalid) {
+      await mkdir(MANIFEST_DIR, { recursive: true });
+      scratchPath = join(MANIFEST_DIR, '__simulate-schema-invalid.json');
+      const invalidDoc = {
+        id: 'simulate-schema-invalid',
+        expression: '(http.request.uri.path matches "^/api/")',
+        period: 60,
+        characteristics: ['ip.src'],
+        action: 'block',
+        duration: 60,
+      };
+      await writeFile(scratchPath, JSON.stringify(invalidDoc, null, 2) + '\n', 'utf8');
+    }
+    const entries = (await readdir(MANIFEST_DIR)).filter((f) => f.endsWith('.json')).sort();
+    for (const name of entries) {
+      const text = await readFile(join(MANIFEST_DIR, name), 'utf8');
+      let doc;
+      try {
+        doc = JSON.parse(text);
+      } catch (err) {
+        results.push({
+          anchorAcId: 'AC-36106-1',
+          verdict: 'fail',
+          detail: `manifest file ${name} does not parse: ${err.message}`,
+        });
+        fileFindings.push({ name, valid: false, errors: [err.message] });
+        continue;
+      }
+      const failures = validateDoc(doc, schema, name);
+      if (failures.length > 0) {
+        results.push({
+          anchorAcId: 'AC-36106-1',
+          verdict: 'fail',
+          detail: failures.join('; '),
+        });
+        fileFindings.push({ name, valid: false, errors: failures });
+      } else {
+        fileFindings.push({ name, valid: true });
+      }
+    }
+  } finally {
+    if (scratchPath) {
+      try { await unlink(scratchPath); } catch {}
+    }
+  }
+  if (results.length === 0) {
+    results.push({
+      anchorAcId: 'AC-36106-1',
+      verdict: 'pass',
+      detail: `every manifest file validates against the shipped draft-07 schema (${fileFindings.length} file(s) inspected; required fields ${REQUIRED_FIELDS.join(', ')}; action enum ${ACTION_ENUM.join('/')}).`,
+    });
+  }
+  return {
+    results,
+    extra: {
+      schemaId: schema.$id,
+      manifestFileCount: fileFindings.length,
+      manifestFiles: fileFindings,
+    },
+  };
+}