rcf-lite 0.23.0 → 0.24.0

package/blueprints/platform-cloudflare-kv/contributions/user-stories/platform-cloudflare-kv-us-31101.json

@@ -0,0 +1,27 @@
+{
+  "usId": "platform-cloudflare-kv-US-31101",
+  "prdId": "PRD-001",
+  "reqId": "platform-cloudflare-kv-REQ-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "The KV facade opens against the elicited binding on boot and emits facadeReady",
+  "asA": "developer whose Worker or Node service needs a small durable KV surface behind a swappable boundary",
+  "iWant": "one KV facade module to hold the Cloudflare Workers KV binding reference and expose typed domain verbs (get, getWithMetadata, put, delete, list), with a facadeReady lifecycle event on the first successful ready-check",
+  "soThat": "the boundary between my domain and the vendor surface is the only place that has to move when the adapter changes, and boot ordering is observable via the event",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-31101-1",
+      "description": "On process boot, the facade opens against the elicited KV binding (env.CACHE on the fixture); once the ready-check resolves, a facadeReady event fires on the injected event sink with a payload of exactly {event, key, size, ttl, timestamp}. The facade exposes typed named domain verbs (get, getWithMetadata, put, delete, list) and does NOT re-export the raw binding.",
+      "given": "a Node or Worker process with the facade module imported and its factory invoked with the elicited binding",
+      "when": "the process boots and the facade ready() call resolves",
+      "then": "a facadeReady event fires on the injected event sink with the metadata-only payload; the facade exposes named domain verbs only; the raw binding is not re-exported",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-3201-platform-cloudflare-kv-facade"
+  ],
+  "createdAt": "2026-09-07T10:27:19.000Z",
+  "updatedAt": "2026-09-07T10:27:19.000Z"
+}

package/blueprints/platform-cloudflare-kv/contributions/user-stories/platform-cloudflare-kv-us-31102.json

@@ -0,0 +1,27 @@
+{
+  "usId": "platform-cloudflare-kv-US-31102",
+  "prdId": "PRD-001",
+  "reqId": "platform-cloudflare-kv-REQ-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "The KV binding reference is dereferenced in exactly one module on the applied fixture",
+  "asA": "operator applying platform-cloudflare-kv v1.0.0",
+  "iWant": "a grep for env.<binding> on the applied fixture src/ tree to return exactly the facade module and no other file",
+  "soThat": "the vendor surface is diffused across zero call sites outside the facade, and a future adapter swap lands without moving any AC",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-31102-1",
+      "description": "A grep for env.CACHE in the cf-platform fixture src/ tree returns exactly one file: src/kv-facade.mjs. No other module dereferences the raw KV binding. The public surface of src/kv-facade.mjs exports the createKvFacade factory only; the raw env.CACHE reference never crosses the module boundary.",
+      "given": "the applied project source tree after apply",
+      "when": "grep -rn env.CACHE walks the src/ tree",
+      "then": "the search returns one file src/kv-facade.mjs and no other match",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-3201-platform-cloudflare-kv-facade"
+  ],
+  "createdAt": "2026-09-07T10:27:19.000Z",
+  "updatedAt": "2026-09-07T10:27:19.000Z"
+}

package/blueprints/platform-cloudflare-kv/contributions/user-stories/platform-cloudflare-kv-us-31103.json

@@ -0,0 +1,36 @@
+{
+  "usId": "platform-cloudflare-kv-US-31103",
+  "prdId": "PRD-001",
+  "reqId": "platform-cloudflare-kv-REQ-002",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Typed put and get round-trip a value through the KV driver realising the Workers KV binding shape",
+  "asA": "developer using the facade behind an app request handler",
+  "iWant": "facade.put(key, value) then facade.get(key) to return the same bytes, with paired kvWrite and kvHit events",
+  "soThat": "a request handler can persist and read state deterministically through one seam",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-31103-1",
+      "description": "facade.put(key, value) writes a value; facade.get(key) returns the same bytes; both operations emit their paired lifecycle events (kvWrite on put, kvHit on get). The round-trip works against the in-memory KV driver in the cf-platform fixture (src/kv-driver.mjs) whose binding shape matches the real Workers KV binding contract per https://developers.cloudflare.com/kv/api/.",
+      "given": "the facade wired to the in-memory KV driver in the cf-platform fixture",
+      "when": "the facade-round-trip probe puts a fixture key/value and reads it back",
+      "then": "the read returns the same bytes; the event sink records one kvWrite and one kvHit; the probe report aggregates to pass",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-31103-2",
+      "description": "facade.delete(key) removes a value; a subsequent facade.get(key) returns null and emits kvMiss.",
+      "given": "a key previously put via the facade",
+      "when": "facade.delete(key) then facade.get(key)",
+      "then": "the delete emits kvWrite; the get returns null and emits kvMiss",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-3201-platform-cloudflare-kv-facade"
+  ],
+  "createdAt": "2026-09-07T10:27:19.000Z",
+  "updatedAt": "2026-09-07T10:27:19.000Z"
+}

package/blueprints/platform-cloudflare-kv/contributions/user-stories/platform-cloudflare-kv-us-31104.json

@@ -0,0 +1,27 @@
+{
+  "usId": "platform-cloudflare-kv-US-31104",
+  "prdId": "PRD-001",
+  "reqId": "platform-cloudflare-kv-REQ-002",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "facade.list({prefix}) returns every key under a prefix with metadata shape intact",
+  "asA": "developer maintaining a set of prefix-scoped feature flags",
+  "iWant": "facade.list({prefix: flags/}) to return every key under the prefix with metadata shape",
+  "soThat": "the applied project can enumerate a prefix-scoped collection through one seam",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-31104-1",
+      "description": "The list-with-prefix probe puts 10 keys under the prefix flags/ (each with a metadata blob) and calls facade.list({prefix: flags/}). The result returns all 10 keys, each entry carrying {name, metadata}, and every name preserves the domain-visible key. A decoy key outside the prefix is NOT included.",
+      "given": "10 keys put under a shared prefix through the facade plus one decoy outside the prefix",
+      "when": "facade.list({prefix: flags/}) runs",
+      "then": "the result carries 10 entries with correct name and metadata fields; the decoy is absent; the aggregate probe verdict is pass",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-3201-platform-cloudflare-kv-facade"
+  ],
+  "createdAt": "2026-09-07T10:27:19.000Z",
+  "updatedAt": "2026-09-07T10:27:19.000Z"
+}

package/blueprints/platform-cloudflare-kv/contributions/user-stories/platform-cloudflare-kv-us-31105.json

@@ -0,0 +1,27 @@
+{
+  "usId": "platform-cloudflare-kv-US-31105",
+  "prdId": "PRD-001",
+  "reqId": "platform-cloudflare-kv-REQ-003",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Cache-aside helper: within-TTL second read is a cache hit and origin is called once",
+  "asA": "developer wrapping a downstream origin call with cache-aside",
+  "iWant": "cache-aside.getOr to invoke origin once on miss, write back with the elicited TTL, and serve subsequent within-TTL reads from cache",
+  "soThat": "the origin surface (a database, a downstream service) is spared one call per cached hit within TTL",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-31105-1",
+      "description": "On first call, cache-aside.getOr(key, originFn) finds nothing in the facade, invokes originFn once, writes back with the elicited TTL, and returns the fresh value with source origin. On the second call within TTL, the read is served from the facade (source cache) and originFn is NOT invoked (the invocation counter stays at 1).",
+      "given": "a fresh key and an origin function that increments a counter each call",
+      "when": "getOr(key, originFn) runs twice within TTL",
+      "then": "the invocation counter reaches 1; both calls return the same value; the second read reports source cache",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-3202-platform-cloudflare-kv-cache-aside"
+  ],
+  "createdAt": "2026-09-07T10:27:19.000Z",
+  "updatedAt": "2026-09-07T10:27:19.000Z"
+}

package/blueprints/platform-cloudflare-kv/contributions/user-stories/platform-cloudflare-kv-us-31106.json

@@ -0,0 +1,27 @@
+{
+  "usId": "platform-cloudflare-kv-US-31106",
+  "prdId": "PRD-001",
+  "reqId": "platform-cloudflare-kv-REQ-003",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Cache-aside helper: past-TTL read miss triggers a second origin call",
+  "asA": "developer relying on cache-aside for staleness bounds",
+  "iWant": "the cache-aside helper to re-invoke origin after the elicited TTL elapses",
+  "soThat": "the applied project observes a bounded staleness ceiling that matches the elicited TTL",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-31106-1",
+      "description": "After the TTL elapses (in-memory driver clock advances past the expiration), cache-aside.getOr(key, originFn) finds nothing and invokes originFn a second time. The invocation counter reaches 2 and the returned value comes from origin.",
+      "given": "a key past its TTL",
+      "when": "getOr(key, originFn) runs after clock advance past TTL",
+      "then": "the invocation counter reaches 2; the returned value comes from origin",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-3202-platform-cloudflare-kv-cache-aside"
+  ],
+  "createdAt": "2026-09-07T10:27:19.000Z",
+  "updatedAt": "2026-09-07T10:27:19.000Z"
+}

package/blueprints/platform-cloudflare-kv/contributions/user-stories/platform-cloudflare-kv-us-31107.json

@@ -0,0 +1,27 @@
+{
+  "usId": "platform-cloudflare-kv-US-31107",
+  "prdId": "PRD-001",
+  "reqId": "platform-cloudflare-kv-REQ-004",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Lifecycle events carry only the metadata-only whitelist",
+  "asA": "operator running the applied logging companion against the KV facade",
+  "iWant": "every lifecycle event on the injected sink to carry only {event, key, size, ttl, timestamp} and nothing else",
+  "soThat": "the log stream can render KV activity without ever writing a body byte or a metadata blob",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-31107-1",
+      "description": "Each lifecycle event emitted by the facade carries EXACTLY the whitelist {event, key, size, ttl, timestamp}. No body value, no metadata blob, no additional field ever appears on the record the sink receives. A whitelist scan on the recorded events returns zero forbidden keys.",
+      "given": "the facade wired to a spy event sink, with a mix of put/get/delete/list operations",
+      "when": "the operations run",
+      "then": "the sink records each event with only the whitelist keys; any extra key trips the probe",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-3203-platform-cloudflare-kv-event-sink"
+  ],
+  "createdAt": "2026-09-07T10:27:19.000Z",
+  "updatedAt": "2026-09-07T10:27:19.000Z"
+}

package/blueprints/platform-cloudflare-kv/contributions/user-stories/platform-cloudflare-kv-us-31108.json

@@ -0,0 +1,27 @@
+{
+  "usId": "platform-cloudflare-kv-US-31108",
+  "prdId": "PRD-001",
+  "reqId": "platform-cloudflare-kv-REQ-004",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Event secrecy: no body bytes or PII reach the sink under a mutation-run",
+  "asA": "operator running the event-secrecy probe on a PII fixture",
+  "iWant": "the probe to prove zero body / PII / user id substring leaves the facade via the sink under both the shipped code path and a mutation-run",
+  "soThat": "the estate can trust the facade never leaks the body to the log stream even when a downstream change tries to",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-31108-1",
+      "description": "The event-secrecy probe puts, gets and deletes a PII fixture (key users/1234/profile, body containing REDACTED-fixture SSN); every event record on the sink carries only the whitelist and no substring of the SSN, no substring of the user id beyond the key itself, and no substring of the body. A mutation-run turning on SIMULATE_PII_LEAK flips the probe to fail with the leaked field named.",
+      "given": "the facade wired to a spy sink with a PII fixture",
+      "when": "put/get/delete operations run on the PII key with the mutation-run switch off then on",
+      "then": "the recorded events contain only the whitelist; PII-substring scan returns zero hits; the mutation-run under SIMULATE_PII_LEAK trips the probe to fail",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-3203-platform-cloudflare-kv-event-sink"
+  ],
+  "createdAt": "2026-09-07T10:27:19.000Z",
+  "updatedAt": "2026-09-07T10:27:19.000Z"
+}

package/blueprints/platform-cloudflare-kv/docs/topics.md

@@ -0,0 +1,71 @@
+# platform-cloudflare-kv blueprint coordination vocabulary
+
+This file is the platform-cloudflare-kv half of the cross-blueprint contract. The Phase 1 conflict detector matches scope:global ADR topics by EXACT string equality, and AC ids are unnamespaced by the 0.4.4 grammar. Any blueprint intended to compose with this one must reuse these exact strings and respect these bands.
+
+## Global ADR topics this blueprint contributes (exact strings)
+
+| Topic string | platform-cloudflare-kv contribution | Origin | Composition note |
+|---|---|---|---|
+| `keyValueStoreContract` | ADR-3201-platform-cloudflare-kv-key-value-store-contract | Minted by this blueprint. Names the wire-shape contract for a key-value store the applied Workers project reads through a facade; the shipped answer is Cloudflare Workers KV with its documented eventual-consistency semantics per https://developers.cloudflare.com/kv/concepts/how-kv-works/. | The one project-wide decision on the key-value-store contract at the facade boundary. A future non-KV adapter (a Redis-shape store, a strong-consistency Durable Objects cell for a single-owner use case) would contribute the same topic string with a different answer, forcing a DELIBERATE conflict the operator resolves with a project-level ADR |
+
+The platform-cloudflare-kv blueprint claims one global topic. Every other contribution is scope-local (ADR-3202 default cache-aside TTL, ADR-3203 key naming convention do not contribute global topics; a composing blueprint that holds an opinion on either authors its own project-level ADR).
+
+Rules for new topics: lower camel case, one concept per topic, no version suffixes. A topic names the decision area, not the chosen answer.
+
+## Id number bands (registry bootstrap)
+
+This table is maintained shelf-wide across every blueprint's `docs/topics.md`. Rows are recorded at ship, never predicted.
+
+| Blueprint | US band | ADR/TAC suffix block | Status | Global topics |
+|---|---|---|---|---|
+| application-spa | 1101-1899 | 2xx | shipped v1.3.0 | `clientRouting`, `theming`, `clientState`, `errorEnvelope`, `authModel` |
+| application-api-rest | 2101-2899 | 3xx | shipped v1.0.0 | `errorEnvelope`, `authModel`, `apiVersioning`, `logging` |
+| security-auth-magic-link | 3101-3899 | 5xx | shipped v1.0.0 | `authModel` |
+| email-smtp-resend | 4101-4899 | 4xx | shipped v1.0.0 | none |
+| hello-panel (walkthrough exemplar) | 4101-4899 | 4xx | doc-reserved; teaching exemplar in `packages/rcf-lite/docs/blueprint-authoring-walkthrough.md`, not shipped as a blueprint directory | `operatorPanel` |
+| persistence-data-sqlite | 5101-5899 | 6xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
+| delivery-ci-workflows | 6101-6899 | 7xx | shipped v2.0.0 (renamed from ci-pipeline) | `ciGates`, `strictCoverageGate`, `releaseArtefacts` |
+| observability-essentials | 7101-7899 | 8xx | shipped v2.0.0 | `statusPageContract` |
+| security-secrets-management | 8101-8899 | 9xx | shipped v1.0.1 | `secretsSource` |
+| security-auth-clerk | 9101-9899 | 10xx | shipped v1.0.0 | `authModel` |
+| security-auth-oauth2 | 10101-10899 | 11xx | shipped v1.0.0 | `authModel` |
+| security-auth-keycloak | 11101-11899 | 12xx | shipped v1.0.0 | `authModel` |
+| deploy-cloudflare-workers | 12101-12899 | 13xx | shipped v1.2.0 | `deploymentTarget` |
+| persistence-data-d1 | 13101-13899 | 14xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
+| observability-probe-endpoints | 14101-14899 | 15xx | shipped v1.1.0 | `healthProbes`, `readinessSemantics` |
+| observability-logging | 15101-15899 | 16xx | shipped v1.0.0 | `logging` |
+| application-error-handling | 16101-16899 | 17xx | shipped v1.0.0 | `errorHandling` |
+| application-datatable | 17101-17899 | 18xx | shipped v1.0.0 | none |
+| application-charts | 18101-18899 | 19xx | shipped v1.0.0 | none |
+| application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
+| application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
+| application-admin-console | 21101-21899 | 22xx | shipped v1.1.0 | `adminConsoleSignInSurface` |
+| application-empty-error-states | 22101-22899 | 23xx | shipped v1.0.0 | none |
+| application-file-upload | 23101-23899 | 24xx | shipped v1.0.0 | none |
+| application-forms-wizard | 24101-24899 | 25xx | shipped v1.0.0 | none |
+| application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
+| application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
+| persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
+| jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
+| platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |
+| platform-cloudflare-cron-triggers | 32101-32899 | 33xx | shipped v1.0.0 | `scheduledTriggerContract` |
+| platform-cloudflare-durable-objects | 33101-33899 | 34xx | shipped v1.0.0 | `strongConsistencyCellContract`, `websocketHubContract` |
+| edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
+| edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
+| edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
+
+US 31101-31108 sit at the LOW end of the 31101-31899 band on purpose (watchpost run-4 lesson). A project-side story mechanically derived from a platform-cloudflare-kv REQ id into the number 31110 would collide against a shipped US-31110; band headroom (31109-31899) leaves that space.
+
+ADR/TAC suffixes for this blueprint use the 3201-3299 block, continuing the shelf pattern.
+
+## Shared expectations for future composing blueprints
+
+- Reuse `keyValueStoreContract` exactly as spelled here when your blueprint holds an opinion on the key-value-store contract at the facade boundary; contribute your own scope:global ADR on that string and let composition surface the pairing.
+- A future non-KV adapter (a Redis-shape store, a strong-consistency Durable Objects cell for a single-owner use case) mints on demand; each claims `keyValueStoreContract` and conflicts by design.
+- Consumer blueprints reading the `keyValueStore` capability declared on `blueprint.json` per section 6a of `blueprint-authoring.md` obtain the facade at apply time via the T-5 visual-round capability-declaration mechanism.
+
+## Deliberate-conflict statement
+
+This blueprint's ADR-3201 on `keyValueStoreContract` is a first shipped answer to a topic that will conflict, by design, with a future non-KV adapter sibling. Applying `platform-cloudflare-kv` alongside such a sibling would raise one `globalAdrTopic` conflict the operator resolves via one of the four documented resolutions per topic (adopt one, keep the existing one, author a project-level supersede ADR, or `--resolve <topic>=project:<ADR-id>` on the add).

package/blueprints/platform-cloudflare-kv/guide/platform-cloudflare-kv.md

@@ -0,0 +1,138 @@
+# platform-cloudflare-kv: the shipped shape
+
+This guide is the two-to-three-screen orientation for a developer
+about to apply `platform-cloudflare-kv` on a Cloudflare Workers
+project. It complements the README (interface reference) and the
+CHANGELOG (version history).
+
+## When to reach for KV
+
+Cloudflare Workers KV is a global, low-latency key-value store
+(<https://developers.cloudflare.com/kv/>). It is the shipped answer
+for:
+
+- Feature flags and small configuration blobs read from every edge
+  request.
+- Session or token caches where a per-request read latency matters
+  more than the write-appearing-instantly-everywhere guarantee.
+- Read-through caches over a slower origin (a database, a downstream
+  API) where a 60-second staleness ceiling is acceptable.
+
+KV is NOT the shipped answer when:
+
+- Every read must reflect the most recent write (KV is eventually
+  consistent).
+- A single key must have one authoritative owner across the fleet
+  (needs a coordinator, not a global cache).
+- The value is mutated by concurrent writers who each expect their
+  write to win in a total order.
+
+Those three cases point at Durable Objects: the round-6 T-3 sibling
+`platform-cloudflare-durable-objects` is the shipped answer for
+strong-consistency needs.
+
+## The eventual-consistency note
+
+Workers KV is documented as eventually consistent
+(<https://developers.cloudflare.com/kv/concepts/how-kv-works/>). Two
+practical consequences the guide surfaces:
+
+1. A write made in one Cloudflare location is usually immediately
+   visible on a same-location read, but not guaranteed to be. On a
+   different location, changes may take up to 60 seconds or more to
+   be visible as cached versions time out.
+2. Negative lookups (indicating a key does not exist) are also
+   cached, creating similar delays when discovering newly created
+   values.
+
+The elicited cache-aside TTL (default 60 seconds per ADR-3202)
+aligns the cache-aside staleness ceiling with the Cloudflare cache
+TTL default so two clocks are one clock. A project that needs
+tighter staleness re-elicits with a smaller TTL; a project that
+needs looser staleness re-elicits with a larger TTL. The TTL floor
+(1 second) is enforced by the cache-aside helper so a misconfigured
+project cannot ship a sub-second TTL.
+
+## Decision tree: KV, Durable Objects, or something else
+
+- Reads dominate writes AND a global staleness ceiling of a few
+  seconds is acceptable AND writes come from few writers -> `platform-cloudflare-kv`.
+- Reads mix with writes AND every read must reflect the most recent
+  write AND one key has one authoritative owner -> `platform-cloudflare-durable-objects` (round-6 T-3).
+- Row-shaped relational data with SQL semantics ->
+  `persistence-data-postgres` or `persistence-data-d1` (via
+  `persistenceStore`).
+- Large binary uploads or reports -> `object-storage-s3` (via
+  `objectStorage`).
+
+## Applying the blueprint
+
+1. Answer the elicited prompts at apply time:
+   - `kv-binding-name`: the binding name the Worker sees on `env`.
+     Default `CACHE`.
+   - `kv-default-cache-ttl-seconds`: the cache-aside default TTL.
+     Default `60`, floor `1`, no upper ceiling imposed by the
+     helper.
+   - `kv-metadata-field-pattern`: recommended default `{v: number}`
+     for a per-key schema version marker.
+   - `kv-key-naming-convention`: `prefixed` (recommended) or
+     `flat` per ADR-3203.
+
+2. Create a KV namespace via `wrangler`:
+
+   ```
+   npx wrangler kv namespace create <kv-binding-name>
+   ```
+
+   Copy the returned `id` and `preview_id` into
+   `wrangler.toml` under `[[kv_namespaces]]`; the shipped fixture
+   uses placeholder ids so `wrangler dev` boots without a live
+   namespace.
+
+3. Import the facade at your app boundary; construct once, pass
+   into request handlers:
+
+   ```js
+   import { createKvFacade } from './src/kv-facade.mjs';
+   import { createCacheAside } from './src/cache-aside.mjs';
+
+   const facade = createKvFacade({
+     binding: env.CACHE,
+     eventSink: emit,
+     defaultCacheTtl: 60,
+   });
+   const cache = createCacheAside({ facade, defaultTtl: 60 });
+   ```
+
+4. Consume the typed verbs:
+
+   ```js
+   const cached = await cache.getOr('flags/feature-1', async () => {
+     const fresh = await fetchFromOrigin();
+     return fresh;
+   });
+   ```
+
+## The event-sink boundary
+
+Every KV operation emits a metadata-only lifecycle event on the
+injected sink: `facadeReady`, `kvHit`, `kvMiss`, `kvWrite`. Each
+record carries EXACTLY `{event, key, size, ttl, timestamp}` and
+nothing else: no body bytes, no metadata pass-through, no user id
+beyond the key itself. The event-secrecy probe drives this at
+mechanism reach with a PII fixture body; the shipped facade passes
+cleanly and a mutation-run under `SIMULATE_PII_LEAK` trips the
+probe to fail.
+
+Wire the sink into the applied logging companion (`observability-
+logging`) so the events render into the log stream without a body
+byte ever leaving the facade.
+
+## Standards references
+
+- <https://developers.cloudflare.com/kv/> (Workers KV overview)
+- <https://developers.cloudflare.com/kv/api/> (binding API)
+- <https://developers.cloudflare.com/kv/concepts/how-kv-works/>
+  (consistency model, default cache TTL)
+- <https://developers.cloudflare.com/kv/platform/limits/> (documented
+  per-namespace limits, the vendor ceiling above the shipped TTL)

package/blueprints/security-auth-clerk/docs/topics.md

@@ -39,7 +39,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | application-charts | 18101-18899 | 19xx | shipped v1.0.0 | none |
 | application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
 | application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
-| application-admin-console | 21101-21899 | 22xx | shipped v1.0.0 | none |
+| application-admin-console | 21101-21899 | 22xx | shipped v1.1.0 | `adminConsoleSignInSurface` |
 | application-empty-error-states | 22101-22899 | 23xx | shipped v1.0.0 | none |
 | application-file-upload | 23101-23899 | 24xx | shipped v1.0.0 | none |
 | application-forms-wizard | 24101-24899 | 25xx | shipped v1.0.0 | none |
@@ -49,6 +49,12 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
+| platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |
+| platform-cloudflare-cron-triggers | 32101-32899 | 33xx | shipped v1.0.0 | `scheduledTriggerContract` |
+| platform-cloudflare-durable-objects | 33101-33899 | 34xx | shipped v1.0.0 | `strongConsistencyCellContract`, `websocketHubContract` |
+| edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
+| edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
+| edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
 
 US 9101-9110 sit at the LOW end of the 9101-9899 band on purpose. A project-side story that mechanically derives from a security-auth-clerk REQ id into the number `9110` would collide against security-auth-clerk-US-9110 in this package; the band leaves headroom at the HIGH end (US 9181-9899) so a project's own stories anchored to security-auth-clerk REQs can allocate without conflict. The watchpost run4 lesson applies here too.
 

package/blueprints/security-auth-keycloak/docs/topics.md

@@ -50,7 +50,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | application-charts | 18101-18899 | 19xx | shipped v1.0.0 | none |
 | application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
 | application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
-| application-admin-console | 21101-21899 | 22xx | shipped v1.0.0 | none |
+| application-admin-console | 21101-21899 | 22xx | shipped v1.1.0 | `adminConsoleSignInSurface` |
 | application-empty-error-states | 22101-22899 | 23xx | shipped v1.0.0 | none |
 | application-file-upload | 23101-23899 | 24xx | shipped v1.0.0 | none |
 | application-forms-wizard | 24101-24899 | 25xx | shipped v1.0.0 | none |
@@ -60,6 +60,12 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
+| platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |
+| platform-cloudflare-cron-triggers | 32101-32899 | 33xx | shipped v1.0.0 | `scheduledTriggerContract` |
+| platform-cloudflare-durable-objects | 33101-33899 | 34xx | shipped v1.0.0 | `strongConsistencyCellContract`, `websocketHubContract` |
+| edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
+| edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
+| edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
 
 US 11101-11113 sit at the LOW end of the 11101-11899 band on purpose. A project-side story that mechanically derives from a security-auth-keycloak REQ id into the number `11113` would collide against security-auth-keycloak-US-11113 in this package; the band leaves headroom at the HIGH end (US 11181-11899) so a project's own stories anchored to security-auth-keycloak REQs can allocate without conflict. The watchpost run4 lesson applies here too.
 

package/blueprints/security-auth-magic-link/docs/topics.md

@@ -39,7 +39,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | application-charts | 18101-18899 | 19xx | shipped v1.0.0 | none |
 | application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
 | application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
-| application-admin-console | 21101-21899 | 22xx | shipped v1.0.0 | none |
+| application-admin-console | 21101-21899 | 22xx | shipped v1.1.0 | `adminConsoleSignInSurface` |
 | application-empty-error-states | 22101-22899 | 23xx | shipped v1.0.0 | none |
 | application-file-upload | 23101-23899 | 24xx | shipped v1.0.0 | none |
 | application-forms-wizard | 24101-24899 | 25xx | shipped v1.0.0 | none |
@@ -49,6 +49,12 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
+| platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |
+| platform-cloudflare-cron-triggers | 32101-32899 | 33xx | shipped v1.0.0 | `scheduledTriggerContract` |
+| platform-cloudflare-durable-objects | 33101-33899 | 34xx | shipped v1.0.0 | `strongConsistencyCellContract`, `websocketHubContract` |
+| edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
+| edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
+| edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
 
 US 3101-3111 sit at the LOW end of the 3101-3899 band on purpose. A project-side story that mechanically derives from `security-auth-magic-link-REQ-011` into the number `3111` would collide against security-auth-magic-link-US-3111 in this package; the band leaves headroom at the HIGH end (US 3181-3899) so a project's own stories anchored to security-auth-magic-link REQs can allocate without conflict.
 

package/blueprints/security-auth-oauth2/docs/topics.md

@@ -50,7 +50,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | application-charts | 18101-18899 | 19xx | shipped v1.0.0 | none |
 | application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
 | application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
-| application-admin-console | 21101-21899 | 22xx | shipped v1.0.0 | none |
+| application-admin-console | 21101-21899 | 22xx | shipped v1.1.0 | `adminConsoleSignInSurface` |
 | application-empty-error-states | 22101-22899 | 23xx | shipped v1.0.0 | none |
 | application-file-upload | 23101-23899 | 24xx | shipped v1.0.0 | none |
 | application-forms-wizard | 24101-24899 | 25xx | shipped v1.0.0 | none |
@@ -60,6 +60,12 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
+| platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |
+| platform-cloudflare-cron-triggers | 32101-32899 | 33xx | shipped v1.0.0 | `scheduledTriggerContract` |
+| platform-cloudflare-durable-objects | 33101-33899 | 34xx | shipped v1.0.0 | `strongConsistencyCellContract`, `websocketHubContract` |
+| edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
+| edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
+| edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
 
 US 10101-10111 sit at the LOW end of the 10101-10899 band on purpose. A project-side story that mechanically derives from a security-auth-oauth2 REQ id into the number `10111` would collide against security-auth-oauth2-US-10111 in this package; the band leaves headroom at the HIGH end (US 10181-10899) so a project's own stories anchored to security-auth-oauth2 REQs can allocate without conflict. The watchpost run4 lesson applies here too.
 

package/blueprints/security-secrets-management/docs/topics.md

@@ -39,7 +39,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | application-charts | 18101-18899 | 19xx | shipped v1.0.0 | none |
 | application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
 | application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
-| application-admin-console | 21101-21899 | 22xx | shipped v1.0.0 | none |
+| application-admin-console | 21101-21899 | 22xx | shipped v1.1.0 | `adminConsoleSignInSurface` |
 | application-empty-error-states | 22101-22899 | 23xx | shipped v1.0.0 | none |
 | application-file-upload | 23101-23899 | 24xx | shipped v1.0.0 | none |
 | application-forms-wizard | 24101-24899 | 25xx | shipped v1.0.0 | none |
@@ -49,6 +49,12 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
+| platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |
+| platform-cloudflare-cron-triggers | 32101-32899 | 33xx | shipped v1.0.0 | `scheduledTriggerContract` |
+| platform-cloudflare-durable-objects | 33101-33899 | 34xx | shipped v1.0.0 | `strongConsistencyCellContract`, `websocketHubContract` |
+| edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
+| edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
+| edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
 
 US 8101-8110 sit at the LOW end of the 8101-8899 band on purpose. A project-side story that mechanically derives from a security-secrets-management REQ id into the number `8110` would collide against security-secrets-management-US-8110 in this package; the band leaves headroom at the HIGH end (US 8181-8899) so a project's own stories anchored to security-secrets-management REQs can allocate without conflict. The watchpost run4 lesson applies here too.
 

package/fixtures/canary-manifest.json

@@ -2,8 +2,8 @@
   "registerCanary": [
     {
       "id": "rc-2026-09-07-001",
-      "createdAt": "2026-09-07T11:12:00.498Z",
-      "buildVersion": "0.23.0-mockdriver",
+      "createdAt": "2026-09-07T23:45:13.314Z",
+      "buildVersion": "0.24.0-mockdriver",
       "fixturePromptId": "canary-prompt-01",
       "responseWordCount": 55,
       "grades": {
@@ -35,8 +35,8 @@
     },
     {
       "id": "rc-2026-09-07-002",
-      "createdAt": "2026-09-07T11:12:00.499Z",
-      "buildVersion": "0.23.0-mockdriver",
+      "createdAt": "2026-09-07T23:45:13.315Z",
+      "buildVersion": "0.24.0-mockdriver",
       "fixturePromptId": "canary-prompt-02",
       "responseWordCount": 55,
       "grades": {
@@ -68,8 +68,8 @@
     },
     {
       "id": "rc-2026-09-07-003",
-      "createdAt": "2026-09-07T11:12:00.499Z",
-      "buildVersion": "0.23.0-mockdriver",
+      "createdAt": "2026-09-07T23:45:13.315Z",
+      "buildVersion": "0.24.0-mockdriver",
       "fixturePromptId": "canary-prompt-03",
       "responseWordCount": 55,
       "grades": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rcf-lite",
-  "version": "0.23.0",
+  "version": "0.24.0",
   "type": "module",
   "description": "One-install tooling for the Requirements Confidence Framework (RCF): the unified `rcf` CLI grouped into the five RCF tool groups (discover, define, build, verify, audit) plus a small core set (init, doctor, guidance, mcp), an MCP server, the live tree viewer and the fresh-context adversarial ship-gate verifier. Consumes @stravica-ai/rcf-schemas.",
   "license": "Apache-2.0",

package/rcf/adrs/adr-2214-application-admin-console-consume-zero-trust-gate.json

@@ -0,0 +1,13 @@
+{
+  "createdAt": "2026-09-07T16:53:45.591Z",
+  "updatedAt": "2026-09-07T17:03:09.431Z",
+  "adrId": "ADR-2214-application-admin-console-consume-zero-trust-gate",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.1.0",
+  "status": "accepted",
+  "title": "Admin-console reads zeroTrustGate at apply-time and switches sign-in surface (recommendedDefault true)",
+  "context": "application-admin-console v1.0.0 shipped with principalDirectory as the sole hard requirement; sign-in surface was local per whatever security-auth-* was applied. Round-6 T-4 introduces edge-cloudflare-access with the zeroTrustGate capability; a composed deployment needs the admin-console to flip its sign-in surface deterministically.",
+  "decision": "application-admin-console v1.1.0 reads appliedCapabilities via readAppliedCapabilities at apply-time. When zeroTrustGate is present the sign-in surface renders access-gated (no local form, principal reads from request.auth); when absent the surface falls back to whatever security-auth-* is applied. Q4 default (spec 5.4.1): zeroTrustGate is CONSUMED OPTIONALLY; principalDirectory remains the sole hard requirement (making Access-gate hard is a v2.0 change). Standards trace clause: Cloudflare round 6 spec section 5.4 (admin-console v1.1.0 delta). recommendedDefault: true.",
+  "consequences": "The v1.1.0 admin-console remains backward-compatible with every v1.0.0 deployment. An Access-gated deployment automatically stops rendering the local login form; the local-login surface still ships in v1.1.0 (fallback branch when zeroTrustGate absent)."
+}