rcf-lite 0.23.0 → 0.24.0

package/blueprints/edge-cloudflare-turnstile/probe-packs/edge-cloudflare-turnstile.pack.mjs

@@ -0,0 +1,146 @@
+// edge-cloudflare-turnstile probe pack (v1.0.0).
+//
+// Four surface-observable checks per cloudflare-round-6-spec section 3.2:
+//   AC-turnstile-widgetRendered      Turnstile widget mounts with the pinned always-pass sitekey and the mount injects no third-party script beyond the Cloudflare Turnstile host.
+//   AC-turnstile-serverVerified-pass Live POST to Cloudflare siteverify with always-pass secret returns success:true and the handler responds 200.
+//   AC-turnstile-serverVerified-fail Live POST to Cloudflare siteverify with always-fail secret returns success:false and the handler rejects 400.
+//   AC-turnstile-magicLinkGuard      Magic-link mint route composed with the Turnstile guard refuses a mint submit without a valid Turnstile response with 400 and no mint side-effect.
+//
+// The pack ships no appliesTo predicate (Turnstile is not capability-gated per spec section 3.2). Every fixture
+// that applies the blueprint fires every check. Runtime URL and browser are supplied by the pack runner; the
+// dedicated pack fixture at packages/rcf-lite/test/fixtures/probe-pack-edge-cloudflare-turnstile pins the
+// Cloudflare public test keys documented at https://developers.cloudflare.com/turnstile/troubleshooting/testing/.
+
+function withUrl(runtimeUrl, path) {
+  return new URL(path, runtimeUrl).toString();
+}
+
+const CLOUDFLARE_TURNSTILE_ORIGIN = 'https://challenges.cloudflare.com';
+
+export default {
+  packName: 'edge-cloudflare-turnstile',
+  version: '1.0.0',
+  blueprintSlug: 'edge-cloudflare-turnstile',
+  appliesTo: () => true,
+  boot: { bootCommand: null, waitForUrl: null, waitForSelector: null },
+  checks: [
+    {
+      id: 'AC-turnstile-widgetRendered',
+      severity: 'block',
+      description: 'Turnstile client widget mounts with the pinned always-pass sitekey; the mount injects Cloudflare Turnstile JS from the Cloudflare Turnstile origin only, populates the Cf-Turnstile-Response token input, and no third-party script from any other origin is loaded on the page.',
+      run: async ({ browser, runtimeUrl }) => {
+        if (!browser) return { verdict: 'fail', detail: 'no packBrowser wired' };
+        await browser.goto(withUrl(runtimeUrl, '/?sitekey=pass'));
+        // Wait for the widget to inject the token. Turnstile fires the callback asynchronously and the always-pass
+        // test sitekey (1x00000000000000000000AA per Cloudflare testing docs) resolves without rendering an iframe.
+        await new Promise((r) => setTimeout(r, 6000));
+        const dom = await browser.evaluate((cfOrigin) => {
+          const widget = document.querySelector('[data-role="turnstile-widget"]');
+          const sitekeyEl = document.querySelector('[data-role="sitekey"]');
+          const scripts = Array.from(document.querySelectorAll('script[src]')).map((s) => s.src);
+          const cloudflareScripts = scripts.filter((s) => s.startsWith(cfOrigin));
+          const thirdParty = scripts.filter((s) => {
+            try { const u = new URL(s); if (u.origin === window.location.origin) return false; return u.origin !== cfOrigin; }
+            catch { return false; }
+          });
+          const tokenInputs = Array.from(document.querySelectorAll('input[name="cf-turnstile-response"]'));
+          const tokenValues = tokenInputs.map((i) => (i.value || '').slice(0, 8));
+          return {
+            widgetPresent: !!widget,
+            sitekey: sitekeyEl ? sitekeyEl.textContent.trim() : null,
+            scriptCount: scripts.length, cloudflareScriptCount: cloudflareScripts.length, thirdPartyScripts: thirdParty,
+            tokenInputCount: tokenInputs.length, tokenValueSample: tokenValues,
+            tokenPopulated: tokenInputs.some((i) => i.value && i.value.length > 0),
+          };
+        }, CLOUDFLARE_TURNSTILE_ORIGIN);
+        if (!dom.widgetPresent) return { verdict: 'fail', detail: 'Turnstile widget element [data-role="turnstile-widget"] not found on /?sitekey=pass' };
+        if (dom.cloudflareScriptCount < 1) return { verdict: 'fail', detail: `Cloudflare Turnstile JS not injected from ${cfOrigin}; scripts=${JSON.stringify(dom)}`.replace('${cfOrigin}', 'https://challenges.cloudflare.com') };
+        if (dom.thirdPartyScripts.length > 0) return { verdict: 'fail', detail: `third-party script(s) present beyond Cloudflare Turnstile: ${JSON.stringify(dom.thirdPartyScripts)}` };
+        if (dom.tokenInputCount < 1) return { verdict: 'fail', detail: `no cf-turnstile-response input in the page after widget mount; DOM=${JSON.stringify(dom)}` };
+        if (!dom.tokenPopulated) return { verdict: 'fail', detail: `cf-turnstile-response input not populated by Turnstile; token samples=${JSON.stringify(dom.tokenValueSample)}` };
+        return { verdict: 'pass', detail: `widget mounted; sitekey=${dom.sitekey}; cloudflareScripts=${dom.cloudflareScriptCount}; tokenPopulated=true tokenSample=${JSON.stringify(dom.tokenValueSample)}; thirdParty=0` };
+      },
+    },
+    {
+      id: 'AC-turnstile-serverVerified-pass',
+      severity: 'block',
+      description: 'Live POST to challenges.cloudflare.com/turnstile/v0/siteverify with the pinned always-pass secret returns success:true; the fixture /api/submit handler responds 200.',
+      run: async ({ browser, runtimeUrl }) => {
+        // Server-side siteverify pass. Uses the browser as a driver to build a form submission then reads
+        // the server response.
+        const body = new URLSearchParams();
+        body.set('email', 'reviewer@example.com');
+        body.set('turnstile-sitekey', '1x00000000000000000000AA');
+        body.set('cf-turnstile-response', 'PACK-CHECK-PASS-TOKEN');
+        const resp = await fetch(withUrl(runtimeUrl, '/api/submit'), {
+          method: 'POST', headers: { 'content-type': 'application/x-www-form-urlencoded' }, body,
+        });
+        const text = await resp.text();
+        let json = null; try { json = JSON.parse(text); } catch { /* leave null */ }
+        const ok = resp.status === 200 && json && json.received === 'ok';
+        return {
+          verdict: ok ? 'pass' : 'fail',
+          detail: ok
+            ? `serverVerified-pass: fixture /api/submit returned status=200 body=${text} (Cloudflare siteverify success:true with always-pass secret)`
+            : `serverVerified-pass unexpected shape status=${resp.status} body=${text}`,
+        };
+      },
+    },
+    {
+      id: 'AC-turnstile-serverVerified-fail',
+      severity: 'block',
+      description: 'Live POST to Cloudflare siteverify with the pinned always-fail secret returns success:false; the fixture /api/submit handler rejects with 400 and refusal body carries errorCodes and no sitekey.',
+      run: async ({ browser, runtimeUrl }) => {
+        const body = new URLSearchParams();
+        body.set('email', 'reviewer@example.com');
+        body.set('turnstile-sitekey', '2x00000000000000000000AB');
+        body.set('cf-turnstile-response', 'PACK-CHECK-FAIL-TOKEN');
+        const resp = await fetch(withUrl(runtimeUrl, '/api/submit?fail-secret=1'), {
+          method: 'POST', headers: { 'content-type': 'application/x-www-form-urlencoded' }, body,
+        });
+        const text = await resp.text();
+        let json = null; try { json = JSON.parse(text); } catch { /* leave null */ }
+        const ok = resp.status === 400 && json && json.errorCode === 'turnstile.siteverify-failed'
+          && Array.isArray(json.errorCodes) && json.errorCodes.length > 0
+          && !text.includes('2x00000000000000000000AB');
+        return {
+          verdict: ok ? 'pass' : 'fail',
+          detail: ok
+            ? `serverVerified-fail: fixture rejected status=400 errorCode=turnstile.siteverify-failed errorCodes=${JSON.stringify(json.errorCodes)}; refusal body carries no sitekey`
+            : `serverVerified-fail unexpected shape status=${resp.status} body=${text}`,
+        };
+      },
+    },
+    {
+      id: 'AC-turnstile-magicLinkGuard',
+      severity: 'block',
+      description: 'Magic-link mint route composed with the Turnstile guard refuses a mint submit without a Turnstile response with 400 and refusal errorCode=turnstile.token-missing; no magic-link mint side-effect.',
+      run: async ({ browser, runtimeUrl }) => {
+        // Two probes: (a) missing token refuse (400), (b) fail-secret refuse (400).
+        const missingBody = new URLSearchParams();
+        missingBody.set('email', 'reviewer@example.com');
+        missingBody.set('turnstile-sitekey', '1x00000000000000000000AA');
+        const missingResp = await fetch(withUrl(runtimeUrl, '/api/magic-link'), {
+          method: 'POST', headers: { 'content-type': 'application/x-www-form-urlencoded' }, body: missingBody,
+        });
+        const missingText = await missingResp.text();
+        let missingJson = null; try { missingJson = JSON.parse(missingText); } catch {}
+        const missingOk = missingResp.status === 400 && missingJson && missingJson.errorCode === 'turnstile.token-missing';
+
+        const failBody = new URLSearchParams();
+        failBody.set('email', 'reviewer@example.com');
+        failBody.set('turnstile-sitekey', '2x00000000000000000000AB');
+        failBody.set('cf-turnstile-response', 'MAGIC-LINK-PACK-FAIL-TOKEN');
+        const failResp = await fetch(withUrl(runtimeUrl, '/api/magic-link?fail-secret=1'), {
+          method: 'POST', headers: { 'content-type': 'application/x-www-form-urlencoded' }, body: failBody,
+        });
+        const failText = await failResp.text();
+        let failJson = null; try { failJson = JSON.parse(failText); } catch {}
+        const failOk = failResp.status === 400 && failJson && failJson.errorCode === 'turnstile.siteverify-failed';
+
+        if (missingOk && failOk) return { verdict: 'pass', detail: `magic-link guard: missing-token refused 400 turnstile.token-missing; fail-secret refused 400 turnstile.siteverify-failed errorCodes=${JSON.stringify(failJson.errorCodes)}` };
+        return { verdict: 'fail', detail: `magic-link guard unexpected: missing status=${missingResp.status} body=${missingText}; fail status=${failResp.status} body=${failText}` };
+      },
+    },
+  ],
+};

package/blueprints/email-smtp-resend/docs/topics.md

@@ -35,7 +35,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | application-charts | 18101-18899 | 19xx | shipped v1.0.0 | none |
 | application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
 | application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
-| application-admin-console | 21101-21899 | 22xx | shipped v1.0.0 | none |
+| application-admin-console | 21101-21899 | 22xx | shipped v1.1.0 | `adminConsoleSignInSurface` |
 | application-empty-error-states | 22101-22899 | 23xx | shipped v1.0.0 | none |
 | application-file-upload | 23101-23899 | 24xx | shipped v1.0.0 | none |
 | application-forms-wizard | 24101-24899 | 25xx | shipped v1.0.0 | none |
@@ -45,6 +45,12 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
+| platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |
+| platform-cloudflare-cron-triggers | 32101-32899 | 33xx | shipped v1.0.0 | `scheduledTriggerContract` |
+| platform-cloudflare-durable-objects | 33101-33899 | 34xx | shipped v1.0.0 | `strongConsistencyCellContract`, `websocketHubContract` |
+| edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
+| edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
+| edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
 
 US 4101-4106 sit at the LOW end of the 4101-4899 band on purpose. A project-side story that mechanically derives from an email-smtp-resend REQ id into the number `4106` (leading `4` + sequence `106`) would collide against email-smtp-resend-US-4106 in this package; the band leaves headroom at the HIGH end (US 4181-4899) so a project's own stories anchored to email-smtp-resend REQs can allocate without conflict. The watchpost run4 lesson applies here too.
 

package/blueprints/jobs-background/docs/topics.md

@@ -39,13 +39,19 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | application-charts | 18101-18899 | 19xx | shipped v1.0.0 | none |
 | application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
 | application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
-| application-admin-console | 21101-21899 | 22xx | shipped v1.0.0 | none |
+| application-admin-console | 21101-21899 | 22xx | shipped v1.1.0 | `adminConsoleSignInSurface` |
 | application-empty-error-states | 22101-22899 | 23xx | shipped v1.0.0 | none |
 | application-file-upload | 23101-23899 | 24xx | shipped v1.0.0 | none |
 | persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
 | object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
+| platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |
+| platform-cloudflare-cron-triggers | 32101-32899 | 33xx | shipped v1.0.0 | `scheduledTriggerContract` |
+| platform-cloudflare-durable-objects | 33101-33899 | 34xx | shipped v1.0.0 | `strongConsistencyCellContract`, `websocketHubContract` |
+| edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
+| edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
+| edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
 
 US 30101-30109 sit at the LOW end of the 30101-30899 band on purpose (watchpost run-4 lesson). A project-side story mechanically derived from a jobs-background REQ id into the number 30110 would collide against a shipped US-30110; band headroom (30110-30899) leaves that space.
 

package/blueprints/messaging-queue-cloudflare/docs/topics.md

@@ -39,13 +39,19 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | application-charts | 18101-18899 | 19xx | shipped v1.0.0 | none |
 | application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
 | application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
-| application-admin-console | 21101-21899 | 22xx | shipped v1.0.0 | none |
+| application-admin-console | 21101-21899 | 22xx | shipped v1.1.0 | `adminConsoleSignInSurface` |
 | application-empty-error-states | 22101-22899 | 23xx | shipped v1.0.0 | none |
 | application-file-upload | 23101-23899 | 24xx | shipped v1.0.0 | none |
 | persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
 | object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
+| platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |
+| platform-cloudflare-cron-triggers | 32101-32899 | 33xx | shipped v1.0.0 | `scheduledTriggerContract` |
+| platform-cloudflare-durable-objects | 33101-33899 | 34xx | shipped v1.0.0 | `strongConsistencyCellContract`, `websocketHubContract` |
+| edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
+| edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
+| edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
 
 US 29101-29108 sit at the LOW end of the 29101-29899 band on purpose (watchpost run-4 lesson). A project-side story mechanically derived from a messaging-queue-cloudflare REQ id into the number 29110 would collide against a shipped US-29110; band headroom (29109-29899) leaves that space.
 

package/blueprints/object-storage-s3/docs/topics.md

@@ -39,7 +39,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | application-charts | 18101-18899 | 19xx | shipped v1.0.0 | none |
 | application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
 | application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
-| application-admin-console | 21101-21899 | 22xx | shipped v1.0.0 | none |
+| application-admin-console | 21101-21899 | 22xx | shipped v1.1.0 | `adminConsoleSignInSurface` |
 | application-empty-error-states | 22101-22899 | 23xx | shipped v1.0.0 | none |
 | application-forms-wizard | 24101-24899 | 25xx | shipped v1.0.0 | none |
 | application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
@@ -48,6 +48,12 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
+| platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |
+| platform-cloudflare-cron-triggers | 32101-32899 | 33xx | shipped v1.0.0 | `scheduledTriggerContract` |
+| platform-cloudflare-durable-objects | 33101-33899 | 34xx | shipped v1.0.0 | `strongConsistencyCellContract`, `websocketHubContract` |
+| edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
+| edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
+| edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
 
 US 28101-28108 sit at the LOW end of the 28101-28899 band on purpose (watchpost run-4 lesson). A project-side story mechanically derived from an object-storage-s3 REQ id into the number 28110 would collide against a shipped US-28110; band headroom (28109-28899) leaves that space.
 

package/blueprints/observability-essentials/docs/topics.md

@@ -54,7 +54,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | application-charts | 18101-18899 | 19xx | shipped v1.0.0 | none |
 | application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
 | application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
-| application-admin-console | 21101-21899 | 22xx | shipped v1.0.0 | none |
+| application-admin-console | 21101-21899 | 22xx | shipped v1.1.0 | `adminConsoleSignInSurface` |
 | application-empty-error-states | 22101-22899 | 23xx | shipped v1.0.0 | none |
 | application-file-upload | 23101-23899 | 24xx | shipped v1.0.0 | none |
 | application-forms-wizard | 24101-24899 | 25xx | shipped v1.0.0 | none |
@@ -64,6 +64,12 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
+| platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |
+| platform-cloudflare-cron-triggers | 32101-32899 | 33xx | shipped v1.0.0 | `scheduledTriggerContract` |
+| platform-cloudflare-durable-objects | 33101-33899 | 34xx | shipped v1.0.0 | `strongConsistencyCellContract`, `websocketHubContract` |
+| edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
+| edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
+| edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
 
 US 7101-7110 sit at the LOW end of the 7101-7899 band on purpose. A project-side story that mechanically derives from an observability-essentials REQs id into the number `7110` would collide against observability-essentials-US-7110 in this package; the band leaves headroom at the HIGH end (US 7181-7899) so a project's own stories anchored to observability-essentials REQs can allocate without conflict. The watchpost run4 lesson applies here too.
 

package/blueprints/observability-logging/docs/topics.md

@@ -21,7 +21,7 @@
 | application-charts | 18101-18899 | 19xx | shipped v1.0.0 | none |
 | application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
 | application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
-| application-admin-console | 21101-21899 | 22xx | shipped v1.0.0 | none |
+| application-admin-console | 21101-21899 | 22xx | shipped v1.1.0 | `adminConsoleSignInSurface` |
 | application-empty-error-states | 22101-22899 | 23xx | shipped v1.0.0 | none |
 | application-file-upload | 23101-23899 | 24xx | shipped v1.0.0 | none |
 | application-forms-wizard | 24101-24899 | 25xx | shipped v1.0.0 | none |
@@ -31,5 +31,11 @@
 | object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
+| platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |
+| platform-cloudflare-cron-triggers | 32101-32899 | 33xx | shipped v1.0.0 | `scheduledTriggerContract` |
+| platform-cloudflare-durable-objects | 33101-33899 | 34xx | shipped v1.0.0 | `strongConsistencyCellContract`, `websocketHubContract` |
+| edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
+| edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
+| edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
 
 The shelf-wide band registry lives in `packages/rcf-lite/docs/blueprint-authoring.md` section 5.

package/blueprints/observability-probe-endpoints/docs/topics.md

@@ -44,7 +44,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | application-charts | 18101-18899 | 19xx | shipped v1.0.0 | none |
 | application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
 | application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
-| application-admin-console | 21101-21899 | 22xx | shipped v1.0.0 | none |
+| application-admin-console | 21101-21899 | 22xx | shipped v1.1.0 | `adminConsoleSignInSurface` |
 | application-empty-error-states | 22101-22899 | 23xx | shipped v1.0.0 | none |
 | application-file-upload | 23101-23899 | 24xx | shipped v1.0.0 | none |
 | application-forms-wizard | 24101-24899 | 25xx | shipped v1.0.0 | none |
@@ -54,6 +54,12 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
+| platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |
+| platform-cloudflare-cron-triggers | 32101-32899 | 33xx | shipped v1.0.0 | `scheduledTriggerContract` |
+| platform-cloudflare-durable-objects | 33101-33899 | 34xx | shipped v1.0.0 | `strongConsistencyCellContract`, `websocketHubContract` |
+| edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
+| edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
+| edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
 
 US 14101-14108 sit at the LOW end of the 14101-14899 band on purpose. A project-side story that mechanically derives from an observability-probe-endpoints REQ id into the number `14108` would collide against observability-probe-endpoints-US-14108 in this package; the band leaves headroom at the HIGH end (US 14181-14899) so a project's own stories anchored to observability-probe-endpoints REQs can allocate without conflict. The watchpost run4 lesson applies here too. Band spacing between the previous HQ-lane row (persistence-data-d1, 13101-13899, 14xx) and this one (14101-14899, 15xx) reflects the four-digit widening pattern opened by security-auth-clerk at 10xx and continued through the round-2 HQ lane.
 

package/blueprints/persistence-data-d1/docs/topics.md

@@ -42,7 +42,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | application-charts | 18101-18899 | 19xx | shipped v1.0.0 | none |
 | application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
 | application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
-| application-admin-console | 21101-21899 | 22xx | shipped v1.0.0 | none |
+| application-admin-console | 21101-21899 | 22xx | shipped v1.1.0 | `adminConsoleSignInSurface` |
 | application-empty-error-states | 22101-22899 | 23xx | shipped v1.0.0 | none |
 | application-file-upload | 23101-23899 | 24xx | shipped v1.0.0 | none |
 | application-forms-wizard | 24101-24899 | 25xx | shipped v1.0.0 | none |
@@ -52,6 +52,12 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
+| platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |
+| platform-cloudflare-cron-triggers | 32101-32899 | 33xx | shipped v1.0.0 | `scheduledTriggerContract` |
+| platform-cloudflare-durable-objects | 33101-33899 | 34xx | shipped v1.0.0 | `strongConsistencyCellContract`, `websocketHubContract` |
+| edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
+| edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
+| edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
 
 US 13101-13107 sit at the LOW end of the 13101-13899 band on purpose. A project-side story that mechanically derives from a persistence-data-d1 REQ id into the number `13107` would collide against persistence-data-d1-US-13107 in this package; the band leaves headroom at the HIGH end (US 13181-13899) so a project's own stories anchored to persistence-data-d1 REQs can allocate without conflict. The watchpost run4 lesson applies here too.
 

package/blueprints/persistence-data-postgres/docs/topics.md

@@ -42,7 +42,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | application-charts | 18101-18899 | 19xx | shipped v1.0.0 | none |
 | application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
 | application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
-| application-admin-console | 21101-21899 | 22xx | shipped v1.0.0 | none |
+| application-admin-console | 21101-21899 | 22xx | shipped v1.1.0 | `adminConsoleSignInSurface` |
 | application-forms-wizard | 24101-24899 | 25xx | shipped v1.0.0 | none |
 | application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
 | application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
@@ -50,6 +50,12 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
+| platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |
+| platform-cloudflare-cron-triggers | 32101-32899 | 33xx | shipped v1.0.0 | `scheduledTriggerContract` |
+| platform-cloudflare-durable-objects | 33101-33899 | 34xx | shipped v1.0.0 | `strongConsistencyCellContract`, `websocketHubContract` |
+| edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
+| edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
+| edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
 
 US 27101-27110 sit at the LOW end of the 27101-27899 band on purpose (watchpost run-4 lesson). A project-side story mechanically derived from a persistence-data-postgres REQ id into the number 27110 would collide against the shipped US-27110; band headroom (27111-27899) leaves that space.
 

package/blueprints/persistence-data-sqlite/docs/topics.md

@@ -42,7 +42,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | application-charts | 18101-18899 | 19xx | shipped v1.0.0 | none |
 | application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
 | application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
-| application-admin-console | 21101-21899 | 22xx | shipped v1.0.0 | none |
+| application-admin-console | 21101-21899 | 22xx | shipped v1.1.0 | `adminConsoleSignInSurface` |
 | application-empty-error-states | 22101-22899 | 23xx | shipped v1.0.0 | none |
 | application-file-upload | 23101-23899 | 24xx | shipped v1.0.0 | none |
 | application-forms-wizard | 24101-24899 | 25xx | shipped v1.0.0 | none |
@@ -52,6 +52,12 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
+| platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |
+| platform-cloudflare-cron-triggers | 32101-32899 | 33xx | shipped v1.0.0 | `scheduledTriggerContract` |
+| platform-cloudflare-durable-objects | 33101-33899 | 34xx | shipped v1.0.0 | `strongConsistencyCellContract`, `websocketHubContract` |
+| edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
+| edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
+| edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
 
 US 5101-5111 sit at the LOW end of the 5101-5899 band on purpose. A project-side story that mechanically derives from `persistence-data-sqlite-REQ-011` into the number `5111` would collide against persistence-data-sqlite-US-5111 in this package; the band leaves headroom at the HIGH end (US 5181-5899) so a project's own stories anchored to persistence-data-sqlite REQs can allocate without conflict. The watchpost run4 lesson applies here too.
 

package/blueprints/platform-cloudflare-cron-triggers/CHANGELOG.md

@@ -0,0 +1,22 @@
+# Changelog
+
+All notable changes to `platform-cloudflare-cron-triggers` are recorded here. The shape follows Keep a Changelog and Semantic Versioning per the blueprint authoring standard.
+
+## 1.0.0 (2026-09-07)
+
+### Added
+
+- v1.0.0 mint of the `platform-cloudflare-cron-triggers` blueprint, category `platform`, capabilities `["scheduledTrigger"]`. Ships a scheduled() handler over the Cloudflare Workers Cron Trigger event, an expression-routed dispatcher over multiple cron expressions, a skew-tolerance classifier, a soft-budget observer, and five metadata-only lifecycle events (`cronReady`, `cronFired`, `cronSkewed`, `cronStalled`, `cronUnmatched`).
+- 4 REQs (`platform-cloudflare-cron-triggers-REQ-001..004`), 7 USs (`platform-cloudflare-cron-triggers-US-32101..32107`), 3 TACs (`TAC-3301` scheduled handler, `TAC-3302` expression-router dispatcher, `TAC-3303` lifecycle-event sink), 3 ADRs (`ADR-3301` scope-global on new topic `scheduledTriggerContract` with `standardsTraceClause: Cloudflare Workers Cron Triggers documented shape`; `ADR-3302` dispatcher mode `elicited: true` `recommendedDefault: expression-routed` when more than one cron expression is elicited; `ADR-3303` default skew tolerance 30 seconds floor 5 ceiling 300 `elicited: true`).
+- 5 Node-only probes under `contributions/probes/`: `wrangler-test-scheduled` (drives `wrangler dev --test-scheduled` on the shared cf-platform fixture, `warn` on CLI regression per spec section 3.1), `dispatcher-routing`, `skew-tolerance` (also folds AC-32104 soft-budget as additional results), `event-secrecy` (SIMULATE_PII_LEAK=true mutation surfaces the leaked fields), and `real-account-scheduled-smoke` (`accountBound: true`; skipped in CI without `CI_HAS_CLOUDFLARE_ACCOUNT`).
+- Elicited parameters on `blueprint.json`: `cron-expressions` (default `* * * * *`), `cron-dispatcher-mode` (default `expression-routed`), `cron-skew-tolerance-seconds` (default `30`, floor `5`, ceiling `300`), `cron-soft-budget-seconds` (default `30`).
+- `suggestedCompanions`: `logging` (for the event-sink boundary) and `errorHandling` (for the handler-failure boundary).
+- Extends the shared `cf-platform` sample-app fixture with the `[triggers] crons` block on `wrangler.toml`, the sole-reader scheduled handler (`src/scheduled.mjs`), and the expression-routed dispatcher (`src/dispatcher.mjs`). The T-0 `[assets]` block and the T-1 `[[kv_namespaces]]` block are preserved verbatim; the scheduled handler does NOT dereference `env.CACHE` (KV stays owned by the T-1 facade).
+- Anatomy test at `packages/rcf-lite/test/blueprint/platform-cloudflare-cron-triggers-anatomy.test.js` covers `TS-090..096` on the T-2 chain slice (blueprint shape, contributions cross-check, probe module contracts, fixture files, ADR bodies and clauses, guide sections and URLs, three-state probed verdicts).
+
+### Known limitations
+
+- The `real-account-scheduled-smoke` probe records `accountBoundSkipped: true` and aggregates to `pass` when `CI_HAS_CLOUDFLARE_ACCOUNT` is unset (spec section 3.5 pass-with-skip). Full mechanism reach requires a CI environment with the paired `CF_ACCOUNT_ID`, `CF_WORKER_NAME` and `CF_API_TOKEN` env vars plus a deployed Worker running a per-minute cron.
+- The `wrangler-test-scheduled` probe returns `warn` (never `fail`) on a CLI regression that prevents `wrangler dev --test-scheduled` from binding within 30 seconds; the in-process `dispatcher-routing` and `skew-tolerance` probes carry the runtime evidence for the shipped handler regardless.
+- The dispatcher does NOT terminate a handler on soft-budget breach; termination is Cloudflare's platform-level concern. A project that needs hard termination on a stalled fire builds it inside the handler code path against `AbortController`.
+- The loader's supported `when` block on `elicits[]` only accepts `requiresCapability` arrays, so `cron-dispatcher-mode` cannot yet gate its `expression-routed` default on `elicitedNonEmpty` over `cron-expressions`. A future loader minor extending `validateElicits` would close that gap; the elicit fires unconditionally today and the guide teaches the pattern.

package/blueprints/platform-cloudflare-cron-triggers/README.md

@@ -0,0 +1,117 @@
+# platform-cloudflare-cron-triggers
+
+A rcf-lite blueprint that ships a small, opinionated wiring over
+Cloudflare Workers Cron Triggers. One module holds the scheduled
+handler; a dispatcher routes multiple cron expressions to distinct
+handlers; every fire emits a metadata-only lifecycle event a
+logging companion can render without ever writing a body byte.
+
+- Version: `1.0.0`
+- Category: `platform`
+- Capabilities: `["scheduledTrigger"]`
+- Suggested companions: `logging`, `errorHandling`
+
+## What it gives you
+
+- One place that dereferences the Cloudflare Workers Cron Trigger
+  event (`src/scheduled.mjs`), wires the dispatcher and the event
+  sink at boot, and emits `cronReady` on the first ready-check.
+- An expression-routed dispatcher (`src/dispatcher.mjs`) that maps
+  cron expressions to distinct handlers, records `cronUnmatched`
+  on an unknown expression, and observes each fire against a
+  skew-tolerance window and a soft budget.
+- Five metadata-only lifecycle events (`cronReady`, `cronFired`,
+  `cronSkewed`, `cronStalled`, `cronUnmatched`) with a bounded
+  payload shape `{event, expression, scheduledTime, outcome,
+  duration}` plus optional numeric fields (`softBudgetMs`,
+  `deltaMs`). Two-layer secrecy assertion in the event-secrecy
+  probe.
+- A decision-tree cross-reference in the guide to `jobs-background`
+  (round 5) and to the follow-up Workflows adapter (round 6 jobs-
+  background 1.1.0 minor bump per spec section 5.7) for cases that
+  need durable, retried, workflow-shaped scheduled work.
+
+## The four REQs
+
+| REQ | What |
+| --- | --- |
+| `platform-cloudflare-cron-triggers-REQ-001` | The scheduled() handler is the sole reader of the Cron Trigger event and opens on boot with `cronReady`. |
+| `platform-cloudflare-cron-triggers-REQ-002` | Multiple cron expressions route to distinct handlers via the expression-router dispatcher. |
+| `platform-cloudflare-cron-triggers-REQ-003` | Skew tolerance: fires observed inside the elicited window are `onTime`; outside record `cronSkewed` with the delta. |
+| `platform-cloudflare-cron-triggers-REQ-004` | Soft budget: a handler running past the elicited budget fires `cronStalled` but the dispatcher does not terminate; every event record is metadata-only. |
+
+## The wired shape
+
+The scheduled handler is the ONE place the Cron Trigger event lives.
+The dispatcher factors the routing, skew and soft-budget concerns
+into one seam. The public surface is:
+
+```
+createScheduledHandler({ routes, eventSink, skewToleranceMs, softBudgetMs, clock? })
+  -> { ready, scheduled }
+```
+
+The dispatcher underneath:
+
+```
+createDispatcher({ routes, eventSink, skewToleranceMs, softBudgetMs, clock? })
+  -> { dispatch }
+```
+
+## Elicited parameters
+
+- `cron-expressions` (default `* * * * *`): the cron expressions
+  to schedule; the operator's comma-separated list is written into
+  `wrangler.toml` under `[triggers] crons`.
+- `cron-dispatcher-mode` (default `expression-routed` when the
+  elicited list has more than one entry, else `single-handler`):
+  the dispatcher mode per `ADR-3302`.
+- `cron-skew-tolerance-seconds` (default `30`, floor `5`, ceiling
+  `300`): the skew tolerance window per `ADR-3303`.
+- `cron-soft-budget-seconds` (default `30`, no floor): the
+  per-handler soft budget.
+
+## The five probes
+
+The five probes live under `contributions/probes/`. Each has a
+matching `run-<probe-name>.mjs` shim that writes a per-blueprint
+report to `.rcf/reports/blueprints/platform-cloudflare-cron-triggers/<probe-name>.json`
+under the fixture root.
+
+| Probe | Anchor AC | Account-bound | What it drives |
+| --- | --- | --- | --- |
+| `wrangler-test-scheduled.mjs` | `AC-32105-1` | no | Spawns `wrangler dev --test-scheduled` on the cf-platform fixture, waits bounded 30 seconds for it to bind, drives `/__scheduled?cron=<expr>`, asserts status 200 and kills wrangler cleanly. Returns `warn` on a CLI regression per spec section 3.1 pass-with-skip. |
+| `dispatcher-routing.mjs` | `AC-32102-1` | no | Wires two spy handlers on two expressions, drives the matched expression (asserting only the routed spy fires with the bounded context), then an unmatched expression (asserting `cronUnmatched` fires and no spy runs). Also covers `AC-32102-2`. |
+| `skew-tolerance.mjs` | `AC-32103-1` | no | Drives the dispatcher against a fake clock aligned to `scheduledTime` (asserting `cronFired` outcome `onTime`) then advanced 60s past (asserting `cronSkewed` with `deltaMs: 60000` and the handler still runs). Also folds soft-budget as additional results: a spy handler resolving after 250ms with `softBudgetMs=100` fires exactly one `cronStalled` at the crossing and a final `cronFired` follows (covers `AC-32103-2`, `AC-32104-1`, `AC-32104-2`). |
+| `event-secrecy.mjs` | `AC-32106-1` | no | Drives the dispatcher with a spy handler that closes over a PII fixture (`{userId, ssn}`); layer-1 asserts every event record's keys are a subset of the allow-list `{event, expression, scheduledTime, outcome, duration, softBudgetMs, deltaMs}`; layer-2 asserts no PII substring in the JSON serialisation. `SIMULATE_PII_LEAK=true` wraps the sink to forward the closure so the mutation-run surfaces the leaked fields and returns `fail`. |
+| `real-account-scheduled-smoke.mjs` | `AC-32107-1` | yes | Polls the Cloudflare Workers analytics API for the named Worker every 5s, waits bounded 90s for a scheduled event to appear. Without `CI_HAS_CLOUDFLARE_ACCOUNT` the probe records `accountBoundSkipped: true` and aggregates to `pass` per spec section 3.5. |
+
+## Known limitations (per-AC mechanism reach)
+
+- **`AC-32105-1` (wrangler dev --test-scheduled)** requires the
+  fixture's `wrangler` devDependency to be installed
+  (`pnpm install --ignore-workspace` in
+  `packages/rcf-lite/test/fixtures/cf-platform`). Without it the
+  probe returns `warn` with a documented gap; the shipped
+  `src/scheduled.mjs` is still exercised end to end by the
+  in-process dispatcher probes.
+- **`AC-32107-1` (real-account live-cron smoke)** requires a live
+  Cloudflare account with a deployed Worker running a per-minute
+  cron plus the paired `CI_HAS_CLOUDFLARE_ACCOUNT=true`,
+  `CF_ACCOUNT_ID`, `CF_WORKER_NAME` and `CF_API_TOKEN` env vars.
+  Without them the probe records `accountBoundSkipped: true` and
+  aggregates to `pass` per spec section 3.5. Full mechanism reach
+  requires a CI environment with those env vars set and a Worker
+  already deployed.
+- **The dispatcher does NOT terminate a handler on soft-budget
+  breach.** Termination is Cloudflare's platform-level concern
+  per https://developers.cloudflare.com/workers/platform/limits/.
+  A project that needs hard termination on a stalled fire builds
+  it inside the handler code path against `AbortController`; the
+  dispatcher's role stops at the `cronStalled` event.
+- **The dispatcher matches by exact string equality on the cron
+  expression.** Wildcarded expression sets or expression-family
+  routing (a single handler for every `*/5 * * * *`-like schedule)
+  are not shipped. A follow-up minor could add a matcher-shape
+  dispatch mode; today the elicited expression list is a
+  one-to-one mapping.

package/blueprints/platform-cloudflare-cron-triggers/blueprint.json

@@ -0,0 +1,85 @@
+{
+  "slug": "platform-cloudflare-cron-triggers",
+  "version": "1.0.0",
+  "category": "platform",
+  "capabilities": ["scheduledTrigger"],
+  "suggestedCompanions": [
+    {
+      "role": "logging",
+      "reason": "Every scheduled fire emits a metadata-only lifecycle event through the applied logger; a logging companion supplies the sink factory."
+    },
+    {
+      "role": "errorHandling",
+      "reason": "A handler failure inside a scheduled invocation constructs an internal error record; an error-handling companion supplies the record factory and the boundary."
+    }
+  ],
+  "elicits": [
+    {
+      "id": "cron-expressions",
+      "prompt": "Cron expressions to schedule (comma-separated list of POSIX cron strings; each expression pairs with one handler under the dispatcher; recommended shape at least one).",
+      "kind": "string",
+      "default": "* * * * *"
+    },
+    {
+      "id": "cron-dispatcher-mode",
+      "prompt": "Dispatcher mode: single-handler routes every fire to one handler; expression-routed maps each expression to a distinct handler (per ADR-3302; recommended default expression-routed when more than one cron expression is elicited).",
+      "kind": "enum",
+      "options": ["single-handler", "expression-routed"],
+      "default": "expression-routed"
+    },
+    {
+      "id": "cron-skew-tolerance-seconds",
+      "prompt": "Skew tolerance in seconds; fires observed within the window are onTime, fires outside record cronSkewed with the delta (per ADR-3303; floor 5 seconds, ceiling 300 seconds).",
+      "kind": "string",
+      "default": "30"
+    },
+    {
+      "id": "cron-soft-budget-seconds",
+      "prompt": "Soft budget per handler in seconds; a handler running past this budget logs cronStalled but is not terminated by the dispatcher (Cloudflare's platform concern retains termination). Recommended default 30.",
+      "kind": "string",
+      "default": "30"
+    }
+  ],
+  "contributions": [
+    { "id": "platform-cloudflare-cron-triggers-REQ-001", "kind": "req", "path": "requirements/platform-cloudflare-cron-triggers-req-001.json" },
+    { "id": "platform-cloudflare-cron-triggers-REQ-002", "kind": "req", "path": "requirements/platform-cloudflare-cron-triggers-req-002.json" },
+    { "id": "platform-cloudflare-cron-triggers-REQ-003", "kind": "req", "path": "requirements/platform-cloudflare-cron-triggers-req-003.json" },
+    { "id": "platform-cloudflare-cron-triggers-REQ-004", "kind": "req", "path": "requirements/platform-cloudflare-cron-triggers-req-004.json" },
+    { "id": "platform-cloudflare-cron-triggers-US-32101", "kind": "us", "path": "user-stories/platform-cloudflare-cron-triggers-us-32101.json" },
+    { "id": "platform-cloudflare-cron-triggers-US-32102", "kind": "us", "path": "user-stories/platform-cloudflare-cron-triggers-us-32102.json" },
+    { "id": "platform-cloudflare-cron-triggers-US-32103", "kind": "us", "path": "user-stories/platform-cloudflare-cron-triggers-us-32103.json" },
+    { "id": "platform-cloudflare-cron-triggers-US-32104", "kind": "us", "path": "user-stories/platform-cloudflare-cron-triggers-us-32104.json" },
+    { "id": "platform-cloudflare-cron-triggers-US-32105", "kind": "us", "path": "user-stories/platform-cloudflare-cron-triggers-us-32105.json" },
+    { "id": "platform-cloudflare-cron-triggers-US-32106", "kind": "us", "path": "user-stories/platform-cloudflare-cron-triggers-us-32106.json" },
+    { "id": "platform-cloudflare-cron-triggers-US-32107", "kind": "us", "path": "user-stories/platform-cloudflare-cron-triggers-us-32107.json" },
+    { "id": "TAC-3301-platform-cloudflare-cron-triggers-scheduled-handler", "kind": "tac", "path": "tacs/tac-3301-platform-cloudflare-cron-triggers-scheduled-handler.json" },
+    { "id": "TAC-3302-platform-cloudflare-cron-triggers-expression-router", "kind": "tac", "path": "tacs/tac-3302-platform-cloudflare-cron-triggers-expression-router.json" },
+    { "id": "TAC-3303-platform-cloudflare-cron-triggers-event-sink", "kind": "tac", "path": "tacs/tac-3303-platform-cloudflare-cron-triggers-event-sink.json" },
+    {
+      "id": "ADR-3301-platform-cloudflare-cron-triggers-scheduled-trigger-contract",
+      "kind": "adr",
+      "path": "adrs/adr-3301-platform-cloudflare-cron-triggers-scheduled-trigger-contract.json",
+      "scope": "global",
+      "topic": "scheduledTriggerContract",
+      "recommendedDefault": true,
+      "elicited": false,
+      "standardsTraceClause": "Cloudflare Workers Cron Triggers documented shape"
+    },
+    {
+      "id": "ADR-3302-platform-cloudflare-cron-triggers-dispatcher-mode",
+      "kind": "adr",
+      "path": "adrs/adr-3302-platform-cloudflare-cron-triggers-dispatcher-mode.json",
+      "recommendedDefault": true,
+      "elicited": true,
+      "standardsTraceClause": "generic enterprise practice"
+    },
+    {
+      "id": "ADR-3303-platform-cloudflare-cron-triggers-skew-tolerance-default",
+      "kind": "adr",
+      "path": "adrs/adr-3303-platform-cloudflare-cron-triggers-skew-tolerance-default.json",
+      "recommendedDefault": true,
+      "elicited": true,
+      "standardsTraceClause": "generic enterprise practice"
+    }
+  ]
+}