rcf-lite 0.23.0 → 0.24.0

package/blueprints/delivery-ci-workflows/docs/topics.md

@@ -53,7 +53,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | application-charts | 18101-18899 | 19xx | shipped v1.0.0 | none |
 | application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
 | application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
-| application-admin-console | 21101-21899 | 22xx | shipped v1.0.0 | none |
+| application-admin-console | 21101-21899 | 22xx | shipped v1.1.0 | `adminConsoleSignInSurface` |
 | application-empty-error-states | 22101-22899 | 23xx | shipped v1.0.0 | none |
 | application-file-upload | 23101-23899 | 24xx | shipped v1.0.0 | none |
 | application-forms-wizard | 24101-24899 | 25xx | shipped v1.0.0 | none |
@@ -63,6 +63,12 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
+| platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |
+| platform-cloudflare-cron-triggers | 32101-32899 | 33xx | shipped v1.0.0 | `scheduledTriggerContract` |
+| platform-cloudflare-durable-objects | 33101-33899 | 34xx | shipped v1.0.0 | `strongConsistencyCellContract`, `websocketHubContract` |
+| edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
+| edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
+| edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
 
 US 6101-6110 sit at the LOW end of the 6101-6899 band on purpose. A project-side story that mechanically derives from `delivery-ci-workflows-REQ-011` into the number `6111` would collide against delivery-ci-workflows-US-6111 in this package; the band leaves headroom at the HIGH end (US 6181-6899) so a project's own stories anchored to delivery-ci-workflows REQs can allocate without conflict. The watchpost run4 lesson applies here too.
 

package/blueprints/deploy-cloudflare-workers/docs/topics.md

@@ -39,7 +39,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | application-charts | 18101-18899 | 19xx | shipped v1.0.0 | none |
 | application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
 | application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
-| application-admin-console | 21101-21899 | 22xx | shipped v1.0.0 | none |
+| application-admin-console | 21101-21899 | 22xx | shipped v1.1.0 | `adminConsoleSignInSurface` |
 | application-empty-error-states | 22101-22899 | 23xx | shipped v1.0.0 | none |
 | application-file-upload | 23101-23899 | 24xx | shipped v1.0.0 | none |
 | application-forms-wizard | 24101-24899 | 25xx | shipped v1.0.0 | none |
@@ -49,6 +49,12 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
+| platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |
+| platform-cloudflare-cron-triggers | 32101-32899 | 33xx | shipped v1.0.0 | `scheduledTriggerContract` |
+| platform-cloudflare-durable-objects | 33101-33899 | 34xx | shipped v1.0.0 | `strongConsistencyCellContract`, `websocketHubContract` |
+| edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
+| edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
+| edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
 
 US 12101-12112 sit at the LOW end of the 12101-12899 band on purpose. A project-side story that mechanically derives from a deploy-cloudflare-workers REQ id into the number `12112` would collide against deploy-cloudflare-workers-US-12112 in this package; the band leaves headroom at the HIGH end (US 12181-12899) so a project's own stories anchored to deploy-cloudflare-workers REQs can allocate without conflict. The watchpost run4 lesson applies here too. Band spacing between the last shipped block (security-secrets-management, 8101-8899, 9xx) and this one (12101-12899, 13xx) leaves the 9xxx-11xxx US bands and the 10xx-12xx suffix blocks open for concurrent-lane authoring so a peer authoring another blueprint in the same PR window does not collide with this one.
 

package/blueprints/edge-cloudflare-access/CHANGELOG.md

@@ -0,0 +1,23 @@
+# Changelog
+
+All notable changes to `edge-cloudflare-access` are recorded here. The shape follows Keep a Changelog and Semantic Versioning per the blueprint authoring standard.
+
+## 1.0.0 (2026-09-07)
+
+### Added
+
+- v1.0.0 mint of the `edge-cloudflare-access` blueprint, category `edge`, capabilities `["zeroTrustGate"]`. Ships a shipped JWT validator middleware that is the sole reader of the `Cf-Access-Jwt-Assertion` header per REQ-001, an Access application declaration surface with elicited hostname or self-hosted-app id, an elicited policy shape from the enum (email-domain, service-token-only, service-token-plus-email-domain, group-membership), a metadata-only audit event contract per REQ-004, and a break-glass posture per REQ-005 with an elicited service-auth pair for CI-signed automation.
+- 6 REQs (`edge-cloudflare-access-REQ-001..006`), 9 USs (`edge-cloudflare-access-US-34101..34109`), 4 TACs (`TAC-3501` JWT validator, `TAC-3502` Access application declaration, `TAC-3503` policy shape enum, `TAC-3504` audit sink), 4 ADRs (`ADR-3501` scope-global on new topic `edgeAuthenticationGate` with `standardsTraceClause: Cloudflare Access policy actions and rule selectors`; `ADR-3502` identity provider elicited with `recommendedDefault: null`; `ADR-3503` policy scope elicited with `recommendedDefault: application-level`; `ADR-3504` audit retention delegated to the applied logging companion with sentinel clause).
+- 6 Node-only probes under `contributions/probes/`: `jwt-validator-fixture` (fixture-signed JWT validates and principal reduces to `{email, sub, groups}` on request.auth), `jwt-validator-reject` (three subcases: missing header, expired exp, mis-signed each return 401 with one metadata-only audit event), `admin-console-gate-surface` (extended admin-console fixture flips its sign-in surface per applied capability set; covers `AC-34108-1`), `audit-event-secrecy` (5 pass + 5 reject runs produce 10 metadata-only records with no forbidden substrings, no token slices, no header names beyond `path`), `real-account-gated-url` (`accountBound: true`; records `accountBoundSkipped: true` in CI without `CI_HAS_CLOUDFLARE_ACCOUNT` per spec section 3.5) and `wrangler-seam` (drives `wrangler dev --local` on the fixture; `/protected` returns HTTP 401 on the shipped validator's missing-header reject path; `/health` returns HTTP 200 exempt; warn semantics per section 3.1 pass-with-skip if wrangler is missing or fails to bind).
+- 6 elicited parameters on `blueprint.json`: `access-application-host` (or `access-selfhosted-app-id`, exactly one required), `access-audience`, `access-jwks-url`, `access-policy-shape` (enum default `email-domain`), `access-bypass-service-auth-id` (blank disables break-glass).
+- `suggestedCompanions`: `logging` (for the metadata-only audit sink retention), `errorHandling` (for the validator failure boundary) and `secretsManagement` (for the paired break-glass service-auth secret).
+- Ships the shared `cf-edge` sample-app fixture at `packages/rcf-lite/test/fixtures/cf-edge/` (T-4 mints it per spec section 3.3). The fixture ships the applied Worker (`src/index.mjs`), the JWT validator (`src/jwt-validator.mjs`, sole reader of the `Cf-Access-Jwt-Assertion` header), a dependency-free RS256 fixture-JWT signer (`test/jwt-signer.mjs`) and a local JWKS server (`test/jwks-server.mjs`). No new rcf-lite runtime dependency (Node's built-in `crypto` module signs and verifies).
+- Extends `packages/rcf-lite/test/fixtures/probe-pack-application-admin-console/` with a `/admin/sign-in` route rendering the Access-gated surface (with `?caps=zeroTrustGate`) or the local-login surface (without). The extension rides `application-admin-console` v1.1.0.
+- Anatomy test at `packages/rcf-lite/test/blueprint/edge-cloudflare-access-anatomy.test.js` covers `TS-110..119` on the T-4 chain slice (blueprint shape, contributions cross-check, JWT validator behaviour, sole-reader guarantee, audit-event secrecy, break-glass posture, admin-console composition, fixture files, ADR bodies and clauses, guide sections and vendor URL).
+
+### Known limitations
+
+- The `real-account-gated-url` probe records `accountBoundSkipped: true` and aggregates to `pass` when `CI_HAS_CLOUDFLARE_ACCOUNT` or `CF_ACCESS_HOST` are unset (spec section 3.5 pass-with-skip). Full mechanism reach requires a CI environment with both env vars set and a deployed hostname behind an issued Zero Trust policy.
+- The v1.0.0 boundary defers per-path policy scope authoring, group-membership rule authoring and identity-provider federation to v1.1.0. The shipped validator observes the JWT's `groups` claim but does not enforce policy on it (the Cloudflare edge enforces before the request reaches the origin Worker); a future minor could ship a group-membership refinement.
+- The `wrangler-seam` probe warns (never fails) when `wrangler` is not installed under `packages/rcf-lite/test/fixtures/cf-edge/node_modules/.bin/wrangler`; a handler thrown at the workerd boundary is a genuine fail per the round-6 T-3 gate directive.
+- The Access-gated sign-in surface on `application-admin-console` v1.1.0 shows a placeholder principal email in the fixture (supplied via `?principalEmail=` or `ADMIN_CONSOLE_PRINCIPAL_EMAIL` env var). In a real deployment the principal reads from `request.auth.email` the JWT validator attaches; the fixture does not embed the validator (it renders the surface).

package/blueprints/edge-cloudflare-access/README.md

@@ -0,0 +1,141 @@
+# edge-cloudflare-access
+
+A rcf-lite blueprint that ships an opinionated wiring for Cloudflare
+Access as the edge authentication gate on a Workers project. One
+JWT validator middleware sits at the top of every fetch handler,
+verifies the JWT Cloudflare Access mints against the JWKS the
+service publishes, and reduces the principal onto `request.auth` as
+`{email, sub, groups}`. Every audit event carries only
+`{email, outcome, timestamp, path}`; no token slice, no header
+value beyond `path` ever leaves the validator boundary.
+
+- Version: `1.0.0`
+- Category: `edge`
+- Capabilities: `["zeroTrustGate"]`
+- Suggested companions: `logging`, `errorHandling`, `secretsManagement`
+
+## When to reach for it
+
+- Any Cloudflare Workers project that needs an authenticated edge
+  (only authenticated principals reach the origin Worker).
+- Any project that has adopted the Zero Trust posture and wants a
+  vendor-neutral seam (`request.auth`) between the edge and the
+  downstream handler.
+- Compose with `application-admin-console` v1.1.0 for the Access-gated
+  sign-in surface (round-4 T-4 capability-minor pattern).
+
+## The six REQs
+
+| REQ | What |
+| --- | --- |
+| `edge-cloudflare-access-REQ-001` | The JWT validator is the sole reader of the `Cf-Access-Jwt-Assertion` header and reduces the principal onto `request.auth`. |
+| `edge-cloudflare-access-REQ-002` | An Access application is declared with an elicited hostname or self-hosted-app id and an elicited policy shape from the enum. |
+| `edge-cloudflare-access-REQ-003` | The operator issues a Zero Trust policy via the guide's dashboard walk-through or the alternative API path. |
+| `edge-cloudflare-access-REQ-004` | The audit event carries only `{email, outcome, timestamp, path}` with no token value or headers. |
+| `edge-cloudflare-access-REQ-005` | Break-glass posture: an elicited bypass-service-auth pair authenticates CI automation. |
+| `edge-cloudflare-access-REQ-006` | Composition with `application-admin-console` v1.1.0: the sign-in surface flips per applied capability set. |
+
+## The wired shape
+
+The validator is the one place the `Cf-Access-Jwt-Assertion` header
+is read. Consumers reach the reduced principal via `request.auth`.
+The public surface is:
+
+```
+createAccessValidator({ env, eventSink, fetch?, clock?, bypassServiceAuth? })
+  -> { validate, middleware }
+```
+
+Where `env` carries the elicited `ACCESS_JWKS_URL` and `ACCESS_AUDIENCE`.
+The `middleware(request, envSwitches?)` returns either
+`{rejected: true, response, outcome}` for a 401 rejection or
+`{rejected: false, outcome}` after attaching `request.auth` in place.
+
+## Elicited parameters
+
+- `access-application-host` OR `access-selfhosted-app-id`: pick
+  exactly one at apply. The dashboard walk-through follows the
+  hostname path when the first is set and the self-hosted-app id
+  path when the second is set.
+- `access-audience`: the JWT audience tag the Access policy issues
+  the validator refuses tokens whose `aud` claim does not match.
+- `access-jwks-url`: the JWKS endpoint URL the validator fetches.
+  Cloudflare Access publishes this at
+  `https://<team>.cloudflareaccess.com/cdn-cgi/access/certs`.
+- `access-policy-shape` (default `email-domain`): one of
+  `email-domain`, `service-token-only`,
+  `service-token-plus-email-domain`, `group-membership`. Drives
+  the guide walk-through and the API alternative.
+- `access-bypass-service-auth-id`: leave blank to disable
+  break-glass. When set, the paired secret is delegated to the
+  applied `secretsManagement` companion via
+  `security-secrets-management`.
+
+## The six probes
+
+The probes live under `contributions/probes/`. Each has a matching
+`run-<probe-name>.mjs` shim that writes a per-blueprint report to
+`.rcf/reports/blueprints/edge-cloudflare-access/<probe-name>.json`
+under the fixture root.
+
+| Probe | anchorAcId | accountBound | What it covers |
+| --- | --- | --- | --- |
+| `jwt-validator-fixture.mjs` | `AC-34101-1` | false | Fixture-signed JWT validates; principal reduces to `{email, sub, groups}` on request.auth; one audit event with `outcome: validated` and allowed keys only. |
+| `jwt-validator-reject.mjs` | `AC-34102-1` | false | Three subcases: missing header, expired exp, mis-signed each return HTTP 401 with exactly one audit event whose keys are drawn from the allowed set; outcomes: `missing`, `expired`, `invalid`. |
+| `admin-console-gate-surface.mjs` | `AC-34108-1` | false | The extended admin-console fixture flips the sign-in surface: with `?caps=zeroTrustGate` it renders `[data-surface=access-gated]`; without it renders `[data-surface=local-login]`. Mutually exclusive on both branches. |
+| `audit-event-secrecy.mjs` | `AC-34106-1` | false | After 5 pass + 5 reject runs, the audit sink holds 10 metadata-only records; the serialised sink contains no substring of any JWT (or its segments) and no header names beyond `path`. |
+| `real-account-gated-url.mjs` | `AC-34109-1` | true | Fetch against a scheduled Access-configured hostname (`CF_ACCESS_HOST`) with `CI_HAS_CLOUDFLARE_ACCOUNT=true` follows the redirect chain to a `<team>.cloudflareaccess.com` URL. Records `accountBoundSkipped: true` without both env vars (pass-with-skip). |
+| `wrangler-seam.mjs` | `AC-34101-1` | false | Spawns `wrangler dev --local` on the cf-edge fixture. `/protected` returns HTTP 401 on the shipped validator's missing-header reject path (workerd boundary); `/health` returns HTTP 200 exempt. Warn semantics per section 3.1 pass-with-skip if wrangler is missing or fails to bind; a handler thrown at the workerd boundary is a fail. |
+
+## Mechanism-reach note
+
+- `AC-34101-1` (fixture JWT validate) and `AC-34102-1` (reject) are
+  covered by the in-process probes plus the wrangler-seam probe
+  under workerd.
+- `AC-34103-1` (sole-reader guarantee) is covered by the anatomy
+  test that greps `src/**/*.mjs` for the header string.
+- `AC-34104-1` (Access application declaration) is covered by the
+  anatomy test that reads `blueprint.json` for the elicits[] shape.
+- `AC-34105-1` (guide dashboard walk-through and API alternative)
+  is covered by the anatomy test that greps the shipped guide file
+  for the two section headings and the vendor URL.
+- `AC-34106-1` (audit metadata secrecy) is covered by the
+  `audit-event-secrecy` probe.
+- `AC-34107-1` (break-glass posture) is covered by the anatomy
+  test that drives the validator with an elicited pair.
+- `AC-34108-1` (admin-console composition) is covered by the
+  `admin-console-gate-surface` probe (both branches) and by the
+  shipped `application-admin-console.pack.mjs` pack check
+  `AC-21815-1` (Playwright-driven on the extended fixture).
+- `AC-34109-1` (real-account gated URL) is covered by the
+  `real-account-gated-url` probe (skipped in CI without both env
+  vars per section 3.5).
+
+## Two-line gate-reviewer boot
+
+```
+cd packages/rcf-lite/test/fixtures/cf-edge
+pnpm install --ignore-workspace
+```
+
+Then run every probe:
+
+```
+node ../../../../../blueprints/edge-cloudflare-access/contributions/probes/run-jwt-validator-fixture.mjs
+node ../../../../../blueprints/edge-cloudflare-access/contributions/probes/run-jwt-validator-reject.mjs
+node ../../../../../blueprints/edge-cloudflare-access/contributions/probes/run-audit-event-secrecy.mjs
+node ../../../../../blueprints/edge-cloudflare-access/contributions/probes/run-admin-console-gate-surface.mjs
+node ../../../../../blueprints/edge-cloudflare-access/contributions/probes/run-real-account-gated-url.mjs
+node ../../../../../blueprints/edge-cloudflare-access/contributions/probes/run-wrangler-seam.mjs
+```
+
+Each probe prints a report envelope and writes it to
+`.rcf/reports/blueprints/edge-cloudflare-access/<probe-name>.json`.
+
+## Composition companion
+
+- `application-admin-console` v1.1.0 consumes `zeroTrustGate`
+  optionally: the admin-console's sign-in surface renders
+  Access-gated when `zeroTrustGate` is in the applied set (and
+  falls back to `security-auth-*` local login otherwise). The
+  v1.1.0 minor rides this PR (round-4 T-4 capability-minor pattern).

package/blueprints/edge-cloudflare-access/blueprint.json

@@ -0,0 +1,197 @@
+{
+  "slug": "edge-cloudflare-access",
+  "version": "1.0.0",
+  "category": "edge",
+  "capabilities": [
+    "zeroTrustGate"
+  ],
+  "suggestedCompanions": [
+    {
+      "role": "logging",
+      "reason": "Every validate-pass, validate-reject and bypass event emits an audit record with metadata-only fields; a logging companion supplies the sink factory."
+    },
+    {
+      "role": "errorHandling",
+      "reason": "A JWKS fetch failure, a signature mismatch, an expired-JWT branch and a missing header each construct a rejection outcome; an error-handling companion supplies the record factory and the boundary."
+    },
+    {
+      "role": "secretsManagement",
+      "reason": "The paired break-glass service-auth secret and the JWKS-URL projection to production are stored in the operator's applied secretsManagement companion; the applied vault seam receives the elicited values at apply time and injects them at deploy."
+    }
+  ],
+  "elicits": [
+    {
+      "id": "access-application-host",
+      "prompt": "Cloudflare Access application hostname the Zero Trust policy is attached to (recommended for hostname-scoped applications). Supply this OR access-selfhosted-app-id.",
+      "kind": "string",
+      "default": ""
+    },
+    {
+      "id": "access-selfhosted-app-id",
+      "prompt": "Cloudflare Access self-hosted application id (recommended for API-managed applications). Supply this OR access-application-host.",
+      "kind": "string",
+      "default": ""
+    },
+    {
+      "id": "access-audience",
+      "prompt": "JWT audience tag the Access policy issues; the validator refuses tokens whose aud claim does not match this string.",
+      "kind": "string",
+      "default": ""
+    },
+    {
+      "id": "access-jwks-url",
+      "prompt": "JWKS endpoint URL the validator fetches keys from. Cloudflare Access publishes this at https://<team>.cloudflareaccess.com/cdn-cgi/access/certs.",
+      "kind": "string",
+      "default": ""
+    },
+    {
+      "id": "access-policy-shape",
+      "prompt": "Access policy shape per TAC-3503. email-domain restricts by @<domain>; service-token-only allows only the elicited bypass-service-auth pair; service-token-plus-email-domain permits both; group-membership binds to an identity-provider group claim (recommended for enterprise SSO).",
+      "kind": "enum",
+      "options": [
+        "email-domain",
+        "service-token-only",
+        "service-token-plus-email-domain",
+        "group-membership"
+      ],
+      "default": "email-domain"
+    },
+    {
+      "id": "access-bypass-service-auth-id",
+      "prompt": "Break-glass service-auth id (per ADR-3502 elicit-only; leave blank to disable break-glass). Recorded on rcf/blueprints/edge-cloudflare-access.applied.json; the paired secret goes through security-secrets-management.",
+      "kind": "string",
+      "default": ""
+    }
+  ],
+  "contributions": [
+    {
+      "id": "edge-cloudflare-access-REQ-001",
+      "kind": "req",
+      "path": "requirements/edge-cloudflare-access-req-001.json"
+    },
+    {
+      "id": "edge-cloudflare-access-REQ-002",
+      "kind": "req",
+      "path": "requirements/edge-cloudflare-access-req-002.json"
+    },
+    {
+      "id": "edge-cloudflare-access-REQ-003",
+      "kind": "req",
+      "path": "requirements/edge-cloudflare-access-req-003.json"
+    },
+    {
+      "id": "edge-cloudflare-access-REQ-004",
+      "kind": "req",
+      "path": "requirements/edge-cloudflare-access-req-004.json"
+    },
+    {
+      "id": "edge-cloudflare-access-REQ-005",
+      "kind": "req",
+      "path": "requirements/edge-cloudflare-access-req-005.json"
+    },
+    {
+      "id": "edge-cloudflare-access-REQ-006",
+      "kind": "req",
+      "path": "requirements/edge-cloudflare-access-req-006.json"
+    },
+    {
+      "id": "edge-cloudflare-access-US-34101",
+      "kind": "us",
+      "path": "user-stories/edge-cloudflare-access-us-34101.json"
+    },
+    {
+      "id": "edge-cloudflare-access-US-34102",
+      "kind": "us",
+      "path": "user-stories/edge-cloudflare-access-us-34102.json"
+    },
+    {
+      "id": "edge-cloudflare-access-US-34103",
+      "kind": "us",
+      "path": "user-stories/edge-cloudflare-access-us-34103.json"
+    },
+    {
+      "id": "edge-cloudflare-access-US-34104",
+      "kind": "us",
+      "path": "user-stories/edge-cloudflare-access-us-34104.json"
+    },
+    {
+      "id": "edge-cloudflare-access-US-34105",
+      "kind": "us",
+      "path": "user-stories/edge-cloudflare-access-us-34105.json"
+    },
+    {
+      "id": "edge-cloudflare-access-US-34106",
+      "kind": "us",
+      "path": "user-stories/edge-cloudflare-access-us-34106.json"
+    },
+    {
+      "id": "edge-cloudflare-access-US-34107",
+      "kind": "us",
+      "path": "user-stories/edge-cloudflare-access-us-34107.json"
+    },
+    {
+      "id": "edge-cloudflare-access-US-34108",
+      "kind": "us",
+      "path": "user-stories/edge-cloudflare-access-us-34108.json"
+    },
+    {
+      "id": "edge-cloudflare-access-US-34109",
+      "kind": "us",
+      "path": "user-stories/edge-cloudflare-access-us-34109.json"
+    },
+    {
+      "id": "TAC-3501-edge-cloudflare-access-jwt-validator",
+      "kind": "tac",
+      "path": "tacs/tac-3501-edge-cloudflare-access-jwt-validator.json"
+    },
+    {
+      "id": "TAC-3502-edge-cloudflare-access-application-declaration",
+      "kind": "tac",
+      "path": "tacs/tac-3502-edge-cloudflare-access-application-declaration.json"
+    },
+    {
+      "id": "TAC-3503-edge-cloudflare-access-policy-shape",
+      "kind": "tac",
+      "path": "tacs/tac-3503-edge-cloudflare-access-policy-shape.json"
+    },
+    {
+      "id": "TAC-3504-edge-cloudflare-access-audit-sink",
+      "kind": "tac",
+      "path": "tacs/tac-3504-edge-cloudflare-access-audit-sink.json"
+    },
+    {
+      "id": "ADR-3501-edge-cloudflare-access-jwt-gate",
+      "kind": "adr",
+      "path": "adrs/adr-3501-edge-cloudflare-access-jwt-gate.json",
+      "scope": "global",
+      "topic": "edgeAuthenticationGate",
+      "recommendedDefault": true,
+      "elicited": false,
+      "standardsTraceClause": "Cloudflare Access policy actions and rule selectors"
+    },
+    {
+      "id": "ADR-3502-edge-cloudflare-access-identity-provider",
+      "kind": "adr",
+      "path": "adrs/adr-3502-edge-cloudflare-access-identity-provider.json",
+      "recommendedDefault": false,
+      "elicited": true,
+      "standardsTraceClause": "generic enterprise practice"
+    },
+    {
+      "id": "ADR-3503-edge-cloudflare-access-policy-scope",
+      "kind": "adr",
+      "path": "adrs/adr-3503-edge-cloudflare-access-policy-scope.json",
+      "recommendedDefault": true,
+      "elicited": true,
+      "standardsTraceClause": "Cloudflare Access policy actions and rule selectors"
+    },
+    {
+      "id": "ADR-3504-edge-cloudflare-access-audit-retention",
+      "kind": "adr",
+      "path": "adrs/adr-3504-edge-cloudflare-access-audit-retention.json",
+      "recommendedDefault": true,
+      "elicited": false,
+      "standardsTraceClause": "generic enterprise practice"
+    }
+  ]
+}

package/blueprints/edge-cloudflare-access/contributions/adrs/adr-3501-edge-cloudflare-access-jwt-gate.json

@@ -0,0 +1,14 @@
+{
+  "adrId": "ADR-3501-edge-cloudflare-access-jwt-gate",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "accepted",
+  "title": "Edge authentication gate: Cloudflare Access Zero-Trust JWT-assertion gate (scope global, new topic edgeAuthenticationGate)",
+  "context": "An applying Workers project has one native edge-authentication answer today: Cloudflare Access. Access enforces the policy at the CF edge, mints a short-lived JWT signed with its own JWKS, and forwards the JWT to the origin Worker in the Cf-Access-Jwt-Assertion header per https://developers.cloudflare.com/cloudflare-one/policies/access/. Every applied Worker needs one project-wide answer to the edgeAuthenticationGate topic; a future non-Cloudflare sibling (Google Cloud IAP, AWS Verified Access, Duo Beyond) would conflict on the same topic.",
+  "decision": "The shipped v1.0.0 default is Cloudflare Access's Zero-Trust JWT-assertion gate. The JWT validator (TAC-3501) is the sole reader of the Cf-Access-Jwt-Assertion header and reduces the principal onto request.auth. The edgeAuthenticationGate topic scope is global on this blueprint; the topic string is edgeAuthenticationGate (lower camel case, one concept per topic, no version suffix). A future non-Cloudflare adapter would contribute the same topic string with a different answer, forcing a DELIBERATE conflict the operator resolves with a project-level ADR.",
+  "consequences": "The applying project inherits Cloudflare's documented Access policy model, the platform-assigned per-application limits and the JWT rotation cadence Access publishes at https://<team>.cloudflareaccess.com/cdn-cgi/access/certs. Standards trace clause: Cloudflare Access policy actions and rule selectors (per https://developers.cloudflare.com/cloudflare-one/policies/access/). Consumers deploying to a non-Cloudflare edge reach for a sibling adapter blueprint that would land as a v1.x minor on this shelf.",
+  "alternativesConsidered": [],
+  "createdAt": "2026-09-07T16:00:00.000Z",
+  "updatedAt": "2026-09-07T16:00:00.000Z"
+}

package/blueprints/edge-cloudflare-access/contributions/adrs/adr-3502-edge-cloudflare-access-identity-provider.json

@@ -0,0 +1,25 @@
+{
+  "adrId": "ADR-3502-edge-cloudflare-access-identity-provider",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "accepted",
+  "title": "Identity provider for the Access application is elicited (recommendedDefault null)",
+  "context": "Cloudflare Access supports many identity providers: One-Time PIN over email, Google, GitHub, Okta, Microsoft Entra ID, SAML, OIDC, mTLS. The choice is an enterprise-integration decision that the shelf cannot pick for the operator: a solo project may take One-Time PIN; a mid-market SaaS may take Google Workspace; a regulated enterprise may take an SSO federation via SAML/OIDC.",
+  "decision": "Identity provider is elicited (elicited: true). No recommended default: recommendedDefault is null. The applied-sidecar records the operator's answer; the guide's dashboard walk-through and API alternative both operate on the selected provider. The break-glass service-auth pair (ADR-3503's elicited posture) is still available regardless of the identity provider, so CI can hit the Worker on top of any provider choice.",
+  "consequences": "The elicitation forces an explicit operator answer at apply. A workspace that never sets an identity provider cannot apply the blueprint (recommendedDefault=null refuses on apply per the shelf norm). Standards trace clause: generic enterprise practice (per the sentinel; no vendor documentation constrains which identity provider a Cloudflare Access application must use).",
+  "alternativesConsidered": [
+    {
+      "name": "Default to One-Time PIN over email",
+      "summary": "Pick OTP as the shipped default so a fresh project applies without an elicitation answer.",
+      "reasonNotChosen": "OTP is a stopgap for prototypes and personal projects; shipping it as the default would push operators to accept it silently in production. Making the choice explicit at apply is the honest posture."
+    },
+    {
+      "name": "Bind to security-auth-* companion",
+      "summary": "Derive the identity provider from whichever security-auth-* blueprint is applied.",
+      "reasonNotChosen": "Cloudflare Access is a distinct identity boundary from a same-app security-auth-* (Clerk, Keycloak, OAuth2, magic-link); an operator running Clerk in the app and Google Workspace as the Access IdP is a legitimate composition. Inference here would surprise the operator."
+    }
+  ],
+  "createdAt": "2026-09-07T16:00:00.000Z",
+  "updatedAt": "2026-09-07T16:00:00.000Z"
+}

package/blueprints/edge-cloudflare-access/contributions/adrs/adr-3503-edge-cloudflare-access-policy-scope.json

@@ -0,0 +1,12 @@
+{
+  "adrId": "ADR-3503-edge-cloudflare-access-policy-scope",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "accepted",
+  "title": "Policy scope: application-level (recommended default) or per-path elicited",
+  "context": "A Cloudflare Access application binds to a hostname or self-hosted-app id and a set of paths. Policies attach at the application level (one policy protects every path) or per-path (different policies for /admin vs /public). Application-level scope is the most common shape and the least surprising; per-path scope is a legitimate answer for a mixed-audience surface.",
+  "decision": "The shipped recommendedDefault is application-level (recommendedDefault: true). The elicited alternative is per-path (elicited: true). The guide's dashboard walk-through covers both paths; the API alternative differs only in the path selector on the policy issuance call. Standards trace clause: Cloudflare Access policy actions and rule selectors (per https://developers.cloudflare.com/cloudflare-one/policies/access/).",
+  "consequences": "A fresh project applying the blueprint gets one application-level policy protecting every path (the simplest deployment); an operator opting into per-path scope elicits a route table and issues one policy per route selector. The validator does not branch on the scope at runtime (the Cloudflare edge enforces the policy).",
+  "alternativesConsidered": []
+}

package/blueprints/edge-cloudflare-access/contributions/adrs/adr-3504-edge-cloudflare-access-audit-retention.json

@@ -0,0 +1,12 @@
+{
+  "adrId": "ADR-3504-edge-cloudflare-access-audit-retention",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "accepted",
+  "title": "Audit retention window (metadata-only fields) is delegated to the applied logging companion",
+  "context": "The validator emits one audit event per outcome with the metadata-only shape {email, outcome, timestamp, path} per REQ-004. Long-term retention (7 days, 90 days, 7 years) is a compliance decision an application-level logging companion (observability-logging, or a dedicated audit-log blueprint) already answers; a per-blueprint retention window would duplicate the answer and diverge over time.",
+  "decision": "The audit event shape is frozen at the validator boundary; retention is delegated verbatim to the applied logging companion (suggestedCompanions[0]). The blueprint declares no retention policy of its own. Standards trace clause: generic enterprise practice (per the sentinel; the metadata-only shape is the blueprint's contribution, retention is the companion's).",
+  "consequences": "A workspace without a logging companion loses the audit events after the Worker context tears down (per Cloudflare Workers semantics); the guide names the trade at apply. A workspace with observability-logging v1.x applied inherits its retention window unchanged.",
+  "alternativesConsidered": []
+}

package/blueprints/edge-cloudflare-access/contributions/probes/admin-console-gate-surface.mjs

@@ -0,0 +1,100 @@
+// Probe: admin-console gate surface - the extended admin-console fixture flips its sign-in surface per applied capability set.
+// anchorAcId: AC-34108-1. accountBound: false.
+//
+// This probe drives the extended probe-pack-application-admin-console fixture over HTTP (no browser).
+// The fixture ships a /admin/sign-in route that renders one of two surfaces based on ?caps=:
+//   - with zeroTrustGate in the caps list: [data-surface=access-gated] + no [data-surface=local-login] +
+//     [data-role=principal-read] with the request.auth email
+//   - without zeroTrustGate: [data-surface=local-login] + no [data-surface=access-gated]
+// The probe boots the fixture server, hits both combinations, greps the DOM for the surface markers,
+// and asserts the mutually exclusive presence. The shipped pack check AC-21815-1 on
+// application-admin-console.pack.mjs is exercised end-to-end in the anatomy test (it uses Playwright);
+// this probe covers the DOM-shape guarantee without a browser dependency.
+
+import { spawn } from 'node:child_process';
+import { resolve, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+export const anchorAcId = 'AC-34108-1';
+export const accountBound = false;
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+const FIXTURE = resolve(HERE, '..', '..', '..', '..', 'packages', 'rcf-lite', 'test', 'fixtures', 'probe-pack-application-admin-console');
+const BIND_CAP_MS = 8000;
+
+async function bootServer() {
+  const proc = spawn(process.execPath, ['server.js'], {
+    cwd: FIXTURE,
+    env: { ...process.env, PORT: '0' },
+    stdio: ['ignore', 'pipe', 'pipe'],
+  });
+  let url = null;
+  let stderrTail = '';
+  proc.stdout.on('data', (buf) => {
+    const s = buf.toString();
+    const match = s.match(/LISTENING\s+(\d+)/);
+    if (match && !url) url = `http://127.0.0.1:${match[1]}`;
+  });
+  proc.stderr.on('data', (b) => { stderrTail = (stderrTail + b.toString()).slice(-2000); });
+  const start = Date.now();
+  while (!url && Date.now() - start < BIND_CAP_MS) {
+    if (proc.exitCode !== null) break;
+    await new Promise((r) => setTimeout(r, 50));
+  }
+  return { proc, url, stderrTail };
+}
+
+async function fetchDom(url, caps) {
+  const target = `${url}/admin/sign-in?caps=${encodeURIComponent(caps)}`;
+  const res = await fetch(target);
+  return { status: res.status, body: await res.text(), target };
+}
+
+async function stop(proc) {
+  if (!proc || proc.killed) return;
+  try { proc.kill('SIGTERM'); } catch (_e) {}
+  await new Promise((r) => setTimeout(r, 300));
+  try { if (!proc.killed) proc.kill('SIGKILL'); } catch (_e) {}
+}
+
+export default async function runProbe() {
+  const { proc, url, stderrTail } = await bootServer();
+  if (!url) {
+    await stop(proc);
+    return { results: [{ anchorAcId: 'AC-34108-1', verdict: 'fail', detail: `admin-console fixture did not bind within ${BIND_CAP_MS}ms; stderr: ${stderrTail}` }] };
+  }
+  const results = [];
+  try {
+    // Gated combination
+    const gated = await fetchDom(url, 'principalDirectory,roleModel,auditLog,zeroTrustGate');
+    const gatedOk =
+      gated.status === 200 &&
+      gated.body.includes('data-surface="access-gated"') &&
+      !gated.body.includes('data-surface="local-login"') &&
+      gated.body.includes('data-role="principal-read"');
+    results.push({
+      anchorAcId: 'AC-34108-1',
+      verdict: gatedOk ? 'pass' : 'fail',
+      detail: gatedOk
+        ? `gated: HTTP 200 with data-surface=access-gated, no data-surface=local-login, data-role=principal-read present at ${gated.target}`
+        : `gated combination did not match; status=${gated.status} accessGatedPresent=${gated.body.includes('data-surface="access-gated"')} localLoginPresent=${gated.body.includes('data-surface="local-login"')} principalReadPresent=${gated.body.includes('data-role="principal-read"')}`,
+    });
+
+    // Fallback combination
+    const fallback = await fetchDom(url, 'principalDirectory,roleModel,auditLog');
+    const fallbackOk =
+      fallback.status === 200 &&
+      fallback.body.includes('data-surface="local-login"') &&
+      !fallback.body.includes('data-surface="access-gated"');
+    results.push({
+      anchorAcId: 'AC-34108-1',
+      verdict: fallbackOk ? 'pass' : 'fail',
+      detail: fallbackOk
+        ? `fallback: HTTP 200 with data-surface=local-login, no data-surface=access-gated at ${fallback.target}`
+        : `fallback combination did not match; status=${fallback.status} localLoginPresent=${fallback.body.includes('data-surface="local-login"')} accessGatedPresent=${fallback.body.includes('data-surface="access-gated"')}`,
+    });
+  } finally {
+    await stop(proc);
+  }
+  return { results };
+}