rcf-lite 0.23.0 → 0.24.0

package/rcf/code-nodes/cn-321.json

@@ -0,0 +1,14 @@
+{
+  "cnId": "CN-321",
+  "path": "../../blueprints/application-admin-console/blueprint.json",
+  "implementsAcIds": [
+    "AC-8501-1",
+    "AC-8601-1",
+    "AC-8602-1"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-07T16:53:58.062Z",
+  "updatedAt": "2026-09-07T16:53:58.062Z"
+}

package/rcf/code-nodes/cn-350.json

@@ -0,0 +1,19 @@
+{
+  "cnId": "CN-350",
+  "path": "../../blueprints/edge-cloudflare-turnstile/blueprint.json",
+  "implementsAcIds": [
+    "AC-9001-1",
+    "AC-9002-1",
+    "AC-9101-1",
+    "AC-9102-1",
+    "AC-9201-1",
+    "AC-9301-1",
+    "AC-9302-1",
+    "AC-9401-1"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-07T19:56:43.636Z",
+  "updatedAt": "2026-09-07T19:56:43.636Z"
+}

package/rcf/code-nodes/cn-380.json

@@ -0,0 +1,19 @@
+{
+  "cnId": "CN-380",
+  "path": "../../blueprints/edge-cloudflare-rate-limiting/blueprint.json",
+  "implementsAcIds": [
+    "AC-10001-1",
+    "AC-10101-1",
+    "AC-10201-1",
+    "AC-10301-1",
+    "AC-10401-1",
+    "AC-10601-1",
+    "AC-10701-1",
+    "AC-10801-1"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-07T21:41:49.036Z",
+  "updatedAt": "2026-09-07T21:41:49.036Z"
+}

package/rcf/fbs/fbs-070.json

@@ -0,0 +1,24 @@
+{
+  "createdAt": "2026-09-07T10:20:33.274Z",
+  "updatedAt": "2026-09-07T10:20:33.274Z",
+  "acIds": [
+    "AC-5001-1",
+    "AC-5002-1",
+    "AC-5101-1",
+    "AC-5101-2",
+    "AC-5102-1",
+    "AC-5201-1",
+    "AC-5201-2",
+    "AC-5301-1",
+    "AC-5302-1",
+    "AC-5401-1"
+  ],
+  "fbsId": "FBS-070",
+  "prdId": "PRD-001",
+  "bsId": "BS-001",
+  "buildOrder": 53,
+  "executionStatus": "notStarted",
+  "title": "T-1 platform-cloudflare-kv v1.0.0: 5 REQs 8 USs 3 TACs 3 ADRs, cf-platform fixture KV extension, 5 Node-only probes, anatomy test",
+  "summary": "HQ round-6 T-1: platform-cloudflare-kv v1.0.0 blueprint on the shelf under blueprints/platform-cloudflare-kv/ (19 contributions: 5 REQs, 8 USs, 3 TACs, 3 ADRs; contributions target 22 to 26 is guidance; sits below at 19 with well-scoped 8-US coverage per spec section 5.1). Adds cf-platform fixture extension (wrangler.toml [[kv_namespaces]] block, src/kv-facade.mjs sole reader, src/cache-aside.mjs helper, src/kv-driver.mjs in-memory driver realising the Workers KV binding shape). Ships 5 Node-only probes under contributions/probes/ (facade-round-trip, cache-aside-hit-then-miss, event-secrecy, list-with-prefix, real-account-eventual-consistency-smoke; the last is accountBound true and records accountBoundSkipped per spec section 3.5 in CI without CI_HAS_CLOUDFLARE_ACCOUNT). Ships blueprint README, guide, CHANGELOG and docs/topics.md, plus the shelf-wide topics.md registry-row for platform-cloudflare-kv on every other blueprint (29 files) and one keyValueStore row on packages/rcf-lite/docs/blueprint-authoring.md section 6a table. Anatomy test at packages/rcf-lite/test/blueprint/platform-cloudflare-kv-anatomy.test.js covers TS-080..087. Repo chain: REQ-050..054 US-5001..5401 TS-080..087 FBS-070 CN-230..234 minted via rcf define create --id per HQ round-6 T-1 reserved-block ruling 2026-09-07T10:12Z. Base commit origin/main 321371e6.",
+  "dependsOnFbsIds": []
+}

package/rcf/fbs/fbs-080.json

@@ -0,0 +1,24 @@
+{
+  "createdAt": "2026-09-07T12:30:06.334Z",
+  "updatedAt": "2026-09-07T12:51:40.075Z",
+  "acIds": [
+    "AC-6001-1",
+    "AC-6002-1",
+    "AC-6003-1",
+    "AC-6101-1",
+    "AC-6101-2",
+    "AC-6201-1",
+    "AC-6201-2",
+    "AC-6301-1",
+    "AC-6301-2",
+    "AC-6302-1"
+  ],
+  "fbsId": "FBS-080",
+  "prdId": "PRD-001",
+  "bsId": "BS-001",
+  "buildOrder": 54,
+  "executionStatus": "notStarted",
+  "title": "T-2 platform-cloudflare-cron-triggers v1.0.0: 4 REQs 7 USs 10 ACs 3 TACs 3 ADRs, cf-platform fixture cron extension, 5 Node-only probes, anatomy test",
+  "summary": "HQ round-6 T-2: platform-cloudflare-cron-triggers v1.0.0 blueprint on the shelf under blueprints/platform-cloudflare-cron-triggers/ (17 contributions: 4 REQs, 7 USs, 3 TACs, 3 ADRs; contributions target 20 to 24 is guidance; sits below at 17 with well-scoped 7-US coverage per spec section 5.2). Adds cf-platform fixture extension (wrangler.toml [triggers] crons block additive over the T-0 [assets] and T-1 [[kv_namespaces]] blocks, src/scheduled.mjs sole reader of the Cron Trigger event, src/dispatcher.mjs expression-routed dispatcher with skew tolerance and soft budget). Ships 5 Node-only probes under contributions/probes/ (wrangler-test-scheduled drives wrangler dev --test-scheduled on the fixture; dispatcher-routing, skew-tolerance and event-secrecy drive the shipped dispatcher in-process; real-account-scheduled-smoke is accountBound true and records accountBoundSkipped per spec section 3.5 in CI without CI_HAS_CLOUDFLARE_ACCOUNT). Ships blueprint README, guide, CHANGELOG and docs/topics.md, plus the shelf-wide topics.md registry-row for platform-cloudflare-cron-triggers on every other blueprint (31 files) and one scheduledTrigger row on packages/rcf-lite/docs/blueprint-authoring.md section 6a table. Anatomy test at packages/rcf-lite/test/blueprint/platform-cloudflare-cron-triggers-anatomy.test.js covers TS-090..096. Repo chain: REQ-060..063 US-6001..6302 TS-090..096 FBS-080 CN-260..267 minted via rcf define create --id per HQ round-6 T-2 reserved-block ruling 2026-09-07T12:25Z. Base commit origin/main 09e14b4.",
+  "dependsOnFbsIds": []
+}

package/rcf/fbs/fbs-090.json

@@ -0,0 +1,24 @@
+{
+  "createdAt": "2026-09-07T14:14:56.524Z",
+  "updatedAt": "2026-09-07T14:15:21.400Z",
+  "acIds": [
+    "AC-7001-1",
+    "AC-7002-1",
+    "AC-7101-1",
+    "AC-7201-1",
+    "AC-7301-1",
+    "AC-7401-1",
+    "AC-7402-1",
+    "AC-7501-1",
+    "AC-7601-1",
+    "AC-7701-1"
+  ],
+  "fbsId": "FBS-090",
+  "prdId": "PRD-001",
+  "bsId": "BS-001",
+  "buildOrder": 55,
+  "executionStatus": "notStarted",
+  "title": "T-3 platform-cloudflare-durable-objects v1.0.0: 8 REQs 10 USs 10 ACs 5 TACs 5 ADRs, cf-platform fixture DO extension, 7 Node-only probes, anatomy test",
+  "summary": "HQ round-6 T-3: platform-cloudflare-durable-objects v1.0.0 blueprint on the shelf under blueprints/platform-cloudflare-durable-objects/ (30 contributions: 8 REQs, 12 USs on the shipped blueprint at ids US-33101..33112, 5 TACs, 5 ADRs). Adds cf-platform fixture DO extension (wrangler.toml [[durable_objects.bindings]] and [[migrations]] blocks additive over the T-0 [assets], T-1 [[kv_namespaces]] and T-2 [triggers] crons blocks; src/do-facade.mjs sole reader of env.CELL and env.HUB; src/do-single-cell.mjs and src/do-hub.mjs shipping SingleCellObject and HubObject classes; src/do-storage.mjs in-memory storage driver realising both sql and kv backends). Ships 7 Node-only probes under contributions/probes/ (namespace-facade-ready, single-cell-concurrent-increment, storage-round-trip, alarm-fires-once, websocket-hub-broadcast folding AC-33106-1 event-secrecy as an additional result, sole-reader-scan and real-account-storage-smoke that is accountBound true and records accountBoundSkipped per spec section 3.5 in CI without CI_HAS_CLOUDFLARE_ACCOUNT). Ships blueprint README, guide, CHANGELOG and docs/topics.md, plus the shelf-wide topics.md registry-row for platform-cloudflare-durable-objects on every prior blueprint (32 files) and two capability rows on packages/rcf-lite/docs/blueprint-authoring.md section 6a table (strongConsistencyCell and hibernatableWebSocket). Anatomy test at packages/rcf-lite/test/blueprint/platform-cloudflare-durable-objects-anatomy.test.js covers TS-100..109. Repo chain: REQ-070..077 US-7001..7002 US-7101 US-7201 US-7301 US-7401..7402 US-7501 US-7601 US-7701 TS-100..109 FBS-090 CN-290..304 minted via rcf define create --id per HQ round-6 T-3 reserved-block ruling 2026-09-07. Base commit origin/main 20cc40d.",
+  "dependsOnFbsIds": []
+}

package/rcf/fbs/fbs-100.json

@@ -0,0 +1,23 @@
+{
+  "createdAt": "2026-09-07T16:53:43.560Z",
+  "updatedAt": "2026-09-07T17:14:55.992Z",
+  "acIds": [
+    "AC-8001-1",
+    "AC-8002-1",
+    "AC-8003-1",
+    "AC-8101-1",
+    "AC-8201-1",
+    "AC-8301-1",
+    "AC-8401-1",
+    "AC-8501-1",
+    "AC-8502-1"
+  ],
+  "fbsId": "FBS-100",
+  "prdId": "PRD-001",
+  "bsId": "BS-001",
+  "buildOrder": 56,
+  "executionStatus": "notStarted",
+  "title": "T-4 edge-cloudflare-access v1.0.0: 6 REQs 9 USs 9 ACs 4 TACs 4 ADRs, cf-edge fixture with JWT signer + JWKS, 5 Node-only probes + 1 wrangler-seam probe, anatomy test",
+  "summary": "HQ round-6 T-4: edge-cloudflare-access v1.0.0 blueprint on the shelf under blueprints/edge-cloudflare-access/. Ships cf-edge fixture with sole-reader JWT validator (Node crypto RS256), local JWKS server and fixture-JWT signer; 6 Node-only probes (4 in-process pass, 1 admin-console gate-surface, 1 accountBound real-account, 1 wrangler-seam warn-on-bind-miss); README, guide with Zero Trust dashboard walk-through and API alternative plus policy shape enum table and break-glass section, CHANGELOG, docs/topics.md; shelf-wide topics.md sweep on 33 blueprints; section 6a zeroTrustGate row on packages/rcf-lite/docs/blueprint-authoring.md. Repo chain: REQ-080..085, US-8001..8502, TS-110..119 plus TCs, FBS-100..101, CN-320..321, TAC-3501..3504, ADR-3501..3504 minted via rcf define create --id per HQ round-6 T-4 reserved-block ruling 2026-09-07. Base commit origin/main cdf84ee.",
+  "dependsOnFbsIds": []
+}

package/rcf/fbs/fbs-101.json

@@ -0,0 +1,16 @@
+{
+  "createdAt": "2026-09-07T16:53:43.745Z",
+  "updatedAt": "2026-09-07T17:14:56.177Z",
+  "acIds": [
+    "AC-8601-1",
+    "AC-8602-1"
+  ],
+  "fbsId": "FBS-101",
+  "prdId": "PRD-001",
+  "bsId": "BS-001",
+  "buildOrder": 57,
+  "executionStatus": "notStarted",
+  "title": "T-4 application-admin-console v1.1.0 additive minor: consume zeroTrustGate optionally, Access-gated sign-in surface pack check AC-21815-1 on the existing application-admin-console.pack.mjs",
+  "summary": "HQ round-6 T-4: application-admin-console v1.1.0 additive minor riding the edge-cloudflare-access PR (round-4 T-4 capability-minor pattern). Bumps blueprint.json to 1.1.0 with 6 new contributions: REQ-014, US-21815, US-21816, TAC-2214, ADR-2214 (scope global on new topic adminConsoleSignInSurface) and pack check AC-21815-1. Extends probe-pack-application-admin-console fixture with /admin/sign-in route. Updates admin-console CHANGELOG with v1.1.0 entry and guide with Access-gate consumption section. Q4 default: consumption is OPTIONAL. Repo chain: REQ-086, US-8601..8602, TAC-2214, ADR-2214.",
+  "dependsOnFbsIds": []
+}

package/rcf/fbs/fbs-110.json

@@ -0,0 +1,23 @@
+{
+  "createdAt": "2026-09-07T19:56:43.448Z",
+  "updatedAt": "2026-09-07T20:06:57.412Z",
+  "summary": "HQ round-6 T-5: edge-cloudflare-turnstile v1.0.0 blueprint on the shelf under blueprints/edge-cloudflare-turnstile/. Ships client widget mount (TAC-3601), server-side siteverify verifier plus refuse-if-token-missing guard (TAC-3602) and composition hook into security-auth-magic-link mint surface (TAC-3603). Four Node-only probes: secret-shape-scan, siteverify-fixture (drives live https://challenges.cloudflare.com/turnstile/v0/siteverify with pinned test keys), guard-shape-scan, event-secrecy. One Playwright pack (edge-cloudflare-turnstile.pack.mjs) with four checks: widgetRendered, serverVerified-pass, serverVerified-fail, magicLinkGuard. Dedicated pack fixture at packages/rcf-lite/test/fixtures/probe-pack-edge-cloudflare-turnstile/ (Node HTTP server, pinned test sitekeys plus secrets from Cloudflare public testing page, magic-link mint stub, break switches for missing-token and other-origin). README, guide with widget-mount snippet plus siteverify curl plus composition example, CHANGELOG, docs/topics.md; shelf-wide topics.md sweep; section 6a humanCheck row on packages/rcf-lite/docs/blueprint-authoring.md. Repo chain: REQ-090..094, US-9001, 9002, 9101, 9102, 9201, 9301, 9302, 9401, TS-120..127 plus TCs, FBS-110, CN-350, TAC-3601..3603, ADR-3601..3603 minted via rcf define create --id per HQ round-6 T-5 reserved-block ruling 2026-09-07. Base commit origin/main 4e25a16.",
+  "dependsOnFbsIds": [],
+  "acIds": [
+    "AC-9001-1",
+    "AC-9002-1",
+    "AC-9101-1",
+    "AC-9102-1",
+    "AC-9201-1",
+    "AC-9301-1",
+    "AC-9302-1",
+    "AC-9401-1"
+  ],
+  "fbsId": "FBS-110",
+  "prdId": "PRD-001",
+  "bsId": "BS-001",
+  "buildOrder": 58,
+  "executionStatus": "notStarted",
+  "title": "T-5 edge-cloudflare-turnstile v1.0.0: 5 REQs 8 USs 8 ACs 3 TACs 3 ADRs, dedicated probe-pack-edge-cloudflare-turnstile fixture with pinned test sitekeys, 4 Node-only probes and 1 Playwright pack with 4 checks",
+  "uiBearing": true
+}

package/rcf/fbs/fbs-120.json

@@ -0,0 +1,22 @@
+{
+  "createdAt": "2026-09-07T21:41:48.747Z",
+  "updatedAt": "2026-09-07T21:42:15.451Z",
+  "acIds": [
+    "AC-10001-1",
+    "AC-10101-1",
+    "AC-10201-1",
+    "AC-10301-1",
+    "AC-10401-1",
+    "AC-10601-1",
+    "AC-10701-1",
+    "AC-10801-1"
+  ],
+  "fbsId": "FBS-120",
+  "prdId": "PRD-001",
+  "bsId": "BS-001",
+  "buildOrder": 59,
+  "executionStatus": "notStarted",
+  "title": "T-6 edge-cloudflare-rate-limiting v1.0.0: 5 REQs, 8 USs, 8 ACs, 3 TACs, 4 ADRs, 4 Node-only probes; cf-edge fixture extended with rate-limit manifests, schema, drift-audit runner and induced-failure switches",
+  "summary": "HQ round-6 T-6: edge-cloudflare-rate-limiting v1.0.0 blueprint on the shelf under blueprints/edge-cloudflare-rate-limiting/. Ships local rate-limit rules manifest (TAC-3701 draft-07 JSON Schema plus cf-edge fixture files cloudflare/rate-limits/example.json and api-writes.json), operator-facing management surface documentation with wrangler and dashboard flows (TAC-3702, guide), and the drift-audit runner realisation in the cf-edge fixture (TAC-3703, src/drift-audit-runner.mjs). Four Node-only probes under blueprints/edge-cloudflare-rate-limiting/contributions/probes/: manifest-presence (AC-10001-1/AC-10801-1 under SIMULATE_MANIFEST_MISSING), manifest-schema-validate (AC-10601-1; SIMULATE_SCHEMA_INVALID negative), event-secrecy (AC-10701-1; SIMULATE_EVENT_LEAK_IP negative) and real-account-burst-and-429 (AC-10201-1; accountBound: true, records accountBoundSkipped without CI_HAS_CLOUDFLARE_ACCOUNT per ruling 6). Blueprint README, guide, docs/topics.md, CHANGELOG; shelf-wide topics.md sweep adding the edge-cloudflare-rate-limiting row across every prior blueprint's docs/topics.md; section 6a edgeRateLimit row on packages/rcf-lite/docs/blueprint-authoring.md. Repo chain: REQ-100..104, US-10001, 10101, 10201, 10301, 10401, 10601, 10701, 10801, TS-130..137 plus TCs, FBS-120, CN-380, TAC-3701..3703, ADR-3701..3704 minted via rcf define create --id per HQ round-6 T-6 reserved-block ruling 2026-09-07. Base commit origin/main 5a22ca6.",
+  "dependsOnFbsIds": []
+}

package/rcf/requirements/req-050.json

@@ -0,0 +1,18 @@
+{
+  "createdAt": "2026-09-07T10:18:25.168Z",
+  "updatedAt": "2026-09-07T10:20:10.276Z",
+  "reqId": "REQ-050",
+  "prdId": "PRD-001",
+  "title": "T-1 platform-cloudflare-kv v1.0.0 blueprint: the KV facade module is the sole reader of the KV binding and opens on boot with facadeReady",
+  "description": "T-1 platform-cloudflare-kv v1.0.0: one KV facade module in the applied project source tree is the SOLE reader of the Cloudflare Workers KV binding (env.CACHE in the fixture; the elicited binding name in a real project). Every other module that touches KV imports the facade and calls its typed domain verbs (get, getWithMetadata, put, delete, list); no other module dereferences the raw KV binding. On process boot, the facade opens against the bound namespace with a bounded list(limit:1) ready-check and emits a facadeReady lifecycle event on the injected event sink. Chain: HQ round-6 T-1 reserved-block, id block REQ-050..054 / US-5001..5401 / TS-080..087 / FBS-070 / CN-230..234 per HQ chain-block ruling 2026-09-07T10:12Z.",
+  "category": "functional",
+  "domain": "platform",
+  "priority": "must",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [],
+    "reason": "content-pending",
+    "classifiedAt": "2026-09-07T10:18:25.198Z"
+  }
+}

package/rcf/requirements/req-051.json

@@ -0,0 +1,18 @@
+{
+  "createdAt": "2026-09-07T10:18:25.373Z",
+  "updatedAt": "2026-09-07T10:20:10.276Z",
+  "reqId": "REQ-051",
+  "prdId": "PRD-001",
+  "title": "T-1 typed put get delete list verbs with metadata field pattern realise the Workers KV binding shape behind the facade",
+  "description": "T-1 typed put get delete list realise the Workers KV binding shape behind the facade. put(key, value, {ttl, metadata}) writes with expirationTtl and metadata to the binding; get(key) returns null on miss; getWithMetadata(key) returns {value, metadata}; delete(key) is idempotent; list({prefix, limit, cursor}) paginates keys with metadata shape intact per the Cloudflare KV binding contract at https://developers.cloudflare.com/kv/api/. Metadata is a JSON-serialisable object; the shipped default metadata field pattern is {v: number} (elicited).",
+  "category": "functional",
+  "domain": "platform",
+  "priority": "must",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [],
+    "reason": "content-pending",
+    "classifiedAt": "2026-09-07T10:18:25.402Z"
+  }
+}

package/rcf/requirements/req-052.json

@@ -0,0 +1,18 @@
+{
+  "createdAt": "2026-09-07T10:18:25.579Z",
+  "updatedAt": "2026-09-07T10:20:10.276Z",
+  "reqId": "REQ-052",
+  "prdId": "PRD-001",
+  "title": "T-1 cache-aside helper reads local first falls back to origin and writes back with elicited TTL floor 1 second",
+  "description": "T-1 cache-aside helper wraps a domain-origin call with the facade. getOr(key, originFn, {ttl}) reads local first via facade.get; on hit returns the cached value with source cache; on miss invokes originFn, writes back through facade.put with the effective TTL (elicited default 60 seconds per ADR-3202; floor 1 second enforced at this seam; no upper ceiling per Cloudflare KV documented per-namespace limits at https://developers.cloudflare.com/kv/platform/limits/), and returns the fresh value with source origin.",
+  "category": "functional",
+  "domain": "platform",
+  "priority": "must",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [],
+    "reason": "content-pending",
+    "classifiedAt": "2026-09-07T10:18:25.608Z"
+  }
+}

package/rcf/requirements/req-053.json

@@ -0,0 +1,18 @@
+{
+  "createdAt": "2026-09-07T10:18:25.784Z",
+  "updatedAt": "2026-09-07T10:20:10.276Z",
+  "reqId": "REQ-053",
+  "prdId": "PRD-001",
+  "title": "T-1 lifecycle events facadeReady kvHit kvMiss kvWrite carry metadata-only fields key size ttl timestamp",
+  "description": "T-1 lifecycle events. The facade emits facadeReady on the injected sink once the ready-check returns; kvHit on a get that resolves to a non-null value; kvMiss on a get that resolves to null; kvWrite on put and delete. Every event record carries EXACTLY the fields {event, key, size, ttl, timestamp}: no body bytes, no metadata bag pass-through, no user id beyond the key itself. The event-secrecy probe drives this at REQ-053 mechanism reach.",
+  "category": "functional",
+  "domain": "platform",
+  "priority": "must",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [],
+    "reason": "content-pending",
+    "classifiedAt": "2026-09-07T10:18:25.813Z"
+  }
+}

package/rcf/requirements/req-054.json

@@ -0,0 +1,18 @@
+{
+  "createdAt": "2026-09-07T10:18:25.999Z",
+  "updatedAt": "2026-09-07T10:20:10.276Z",
+  "reqId": "REQ-054",
+  "prdId": "PRD-001",
+  "title": "T-1 eventual-consistency note in the guide: a write may not appear on a global read within the same request and the elicited TTL sets the staleness ceiling",
+  "description": "T-1 eventual-consistency note: Workers KV is eventually consistent per the Cloudflare KV consistency documentation at https://developers.cloudflare.com/kv/concepts/how-kv-works/. A write may not appear on a global read within the same request; the elicited cache-aside TTL (default 60 seconds per Cloudflare-documented cache TTL default) sets the staleness ceiling readers observe. The guide surfaces the note and the decision-tree cross-reference to platform-cloudflare-durable-objects for strong-consistency needs (round-6 T-3 owns the DO adapter).",
+  "category": "functional",
+  "domain": "platform",
+  "priority": "must",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [],
+    "reason": "content-pending",
+    "classifiedAt": "2026-09-07T10:18:26.039Z"
+  }
+}

package/rcf/requirements/req-060.json

@@ -0,0 +1,20 @@
+{
+  "createdAt": "2026-09-07T12:26:47.779Z",
+  "updatedAt": "2026-09-07T12:26:47.813Z",
+  "description": "T-2 platform-cloudflare-cron-triggers v1.0.0: one scheduled() handler in the applied project source tree is the SOLE reader of the Cloudflare Workers Cron Trigger event (the event handler shape documented at https://developers.cloudflare.com/workers/configuration/cron-triggers/). The handler binds on boot, wires the dispatcher (REQ-061) and the event sink (per TAC-3303), and emits a cronReady lifecycle event on the injected sink with a metadata-only payload. Chain: HQ round-6 T-2 reserved-block per HQ chain-block ruling 2026-09-07T12:25Z.",
+  "category": "functional",
+  "domain": "platform",
+  "priority": "must",
+  "reqId": "REQ-060",
+  "prdId": "PRD-001",
+  "title": "T-2 platform-cloudflare-cron-triggers v1.0.0 blueprint: the scheduled() handler is the sole reader of the Cron Trigger event and opens on boot with cronReady",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [
+      "none"
+    ],
+    "reason": "keyword-scan",
+    "classifiedAt": "2026-09-07T12:26:47.812Z"
+  }
+}

package/rcf/requirements/req-061.json

@@ -0,0 +1,18 @@
+{
+  "createdAt": "2026-09-07T12:26:47.991Z",
+  "updatedAt": "2026-09-07T12:28:41.280Z",
+  "description": "T-2 platform-cloudflare-cron-triggers v1.0.0: the dispatcher module accepts an ordered map of cron-expression to handler pairs and, on every scheduled() invocation, matches the incoming Cron Trigger event's cron expression against the map and routes exactly to the matched handler. An unmatched expression records an unmatchedExpression event on the sink and the scheduled invocation returns without side effect. The routed handler receives a bounded context {expression, scheduledTime, sink} so its own emissions can be attributed. Chain: HQ round-6 T-2 reserved-block per HQ chain-block ruling 2026-09-07T12:25Z.",
+  "category": "functional",
+  "domain": "platform",
+  "priority": "must",
+  "reqId": "REQ-061",
+  "prdId": "PRD-001",
+  "title": "T-2 expression-router: multiple cron expressions route to distinct handlers by expression match",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [],
+    "reason": "content-pending",
+    "classifiedAt": "2026-09-07T12:29:00.000Z"
+  }
+}

package/rcf/requirements/req-062.json

@@ -0,0 +1,20 @@
+{
+  "createdAt": "2026-09-07T12:26:48.199Z",
+  "updatedAt": "2026-09-07T12:26:48.232Z",
+  "description": "T-2 platform-cloudflare-cron-triggers v1.0.0: an elicited skew-tolerance window (default 30 seconds per ADR-3303; floor 5s, ceiling 5 minutes) governs how the dispatcher classifies a fire. If the observed handler start time is within the window of the event's scheduledTime, the fire's outcome is onTime and a cronFired event carries {expression, scheduledTime, outcome: onTime, duration}. If the observed start is outside the window, a cronSkewed event fires with the delta (observed minus scheduled, in milliseconds) and the outcome is skewed; the handler still runs. Chain: HQ round-6 T-2 reserved-block per HQ chain-block ruling 2026-09-07T12:25Z.",
+  "category": "functional",
+  "domain": "platform",
+  "priority": "must",
+  "reqId": "REQ-062",
+  "prdId": "PRD-001",
+  "title": "T-2 skew tolerance: a fire inside the elicited window is onTime; outside it records cronSkewed with the delta",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [
+      "none"
+    ],
+    "reason": "keyword-scan",
+    "classifiedAt": "2026-09-07T12:26:48.230Z"
+  }
+}

package/rcf/requirements/req-063.json

@@ -0,0 +1,20 @@
+{
+  "createdAt": "2026-09-07T12:26:48.409Z",
+  "updatedAt": "2026-09-07T12:26:48.442Z",
+  "description": "T-2 platform-cloudflare-cron-triggers v1.0.0: an elicited soft-budget duration (default 30 seconds per elicited answer, no floor) governs when a running handler is flagged as stalled. The dispatcher never terminates a handler on soft-budget breach (Cloudflare's platform concern is the sole terminator); it fires a cronStalled event with metadata-only payload {expression, scheduledTime, outcome: stalled, duration, softBudgetMs} at the moment the observed duration crosses the budget and lets the handler continue. Every scheduled-side event record on the sink carries only {expression, scheduledTime, outcome, duration} plus the event tag; handler input closures, PII fields and body bytes never cross the sink boundary. Chain: HQ round-6 T-2 reserved-block per HQ chain-block ruling 2026-09-07T12:25Z.",
+  "category": "functional",
+  "domain": "platform",
+  "priority": "must",
+  "reqId": "REQ-063",
+  "prdId": "PRD-001",
+  "title": "T-2 soft budget and event secrecy: a handler running past the elicited budget logs cronStalled but does not terminate; every event record is metadata-only",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [
+      "none"
+    ],
+    "reason": "keyword-scan",
+    "classifiedAt": "2026-09-07T12:26:48.441Z"
+  }
+}

package/rcf/requirements/req-070.json

@@ -0,0 +1,18 @@
+{
+  "createdAt": "2026-09-07T14:11:36.742Z",
+  "updatedAt": "2026-09-07T14:13:26.508Z",
+  "reqId": "REQ-070",
+  "prdId": "PRD-001",
+  "title": "T-3 platform-cloudflare-durable-objects v1.0.0 blueprint: the DO facade is the sole reader of env.CELL and env.HUB and opens on boot with namespaceReady",
+  "description": "T-3 platform-cloudflare-durable-objects v1.0.0: one DO facade module in the applied project source tree is the SOLE reader of env.CELL and env.HUB (per https://developers.cloudflare.com/durable-objects/). On process boot, the facade wires the injected event sink and emits a namespaceReady lifecycle event with a metadata-only payload; the facade exposes typed handles per named object (cellHandle(name), hubHandle(name)) and never exposes the raw binding to consumers. Chain: HQ round-6 T-3 reserved-block per HQ chain-block ruling 2026-09-07 (REQ-070..079 / US-70xx..79xx / TS-100..109 / FBS-090..099 / CN-290..319).",
+  "category": "functional",
+  "domain": "platform",
+  "priority": "must",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [],
+    "reason": "content-pending",
+    "classifiedAt": "2026-09-07T14:11:36.775Z"
+  }
+}

package/rcf/requirements/req-071.json

@@ -0,0 +1,18 @@
+{
+  "createdAt": "2026-09-07T14:11:36.953Z",
+  "updatedAt": "2026-09-07T14:13:26.508Z",
+  "reqId": "REQ-071",
+  "prdId": "PRD-001",
+  "title": "T-3 single-cell shape exposes typed domain verbs and serialises concurrent invocations per instance",
+  "description": "T-3 single-cell shape: a named SingleCellObject exposes typed domain verbs (increment, read, reset) that wrap the injected storage driver. Cloudflare's documented DO consistency model serialises invocations against the same instance; the shipped class realises that contract via a per-instance FIFO promise queue so a concurrent-increment probe observes the counter sum and one increment observed the other via a written witness (per REQ-071 and AC-33102-1, AC-33109-1).",
+  "category": "functional",
+  "domain": "platform",
+  "priority": "must",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [],
+    "reason": "content-pending",
+    "classifiedAt": "2026-09-07T14:11:36.986Z"
+  }
+}

package/rcf/requirements/req-072.json

@@ -0,0 +1,18 @@
+{
+  "createdAt": "2026-09-07T14:11:37.164Z",
+  "updatedAt": "2026-09-07T14:13:26.508Z",
+  "reqId": "REQ-072",
+  "prdId": "PRD-001",
+  "title": "T-3 storage API provides typed put/get/delete on the object with an elicited backend (SQL or KV)",
+  "description": "T-3 storage API: the object's state.storage surface exposes typed put(key,value), get(key), delete(key) and list({prefix}) verbs. Storage backend is elicited (sql or kv per ADR-3403); the shipped storage driver factory is backend-agnostic and threads through the elicited answer as driver.backend. A storage-round-trip probe drives both backends via a fixture switch (AC-33103-1, AC-33111-1).",
+  "category": "functional",
+  "domain": "platform",
+  "priority": "must",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [],
+    "reason": "content-pending",
+    "classifiedAt": "2026-09-07T14:11:37.197Z"
+  }
+}

package/rcf/requirements/req-073.json

@@ -0,0 +1,18 @@
+{
+  "createdAt": "2026-09-07T14:11:37.377Z",
+  "updatedAt": "2026-09-07T14:13:26.508Z",
+  "reqId": "REQ-073",
+  "prdId": "PRD-001",
+  "title": "T-3 alarm surface fires alarm() exactly once per scheduled time and doAlarmFired carries objectName and scheduledTime",
+  "description": "T-3 alarm surface: a named object supports storage.setAlarm(scheduledTime) and an alarm() handler. The shipped alarm handler drains the persisted alarm from storage on each fire so a second alarm() call on the drained storage does not re-fire for the same schedule; the injected event sink records a doAlarmFired event with {objectName, scheduledTime} metadata fields on each fire (AC-33104-1, AC-33106-1).",
+  "category": "functional",
+  "domain": "platform",
+  "priority": "must",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [],
+    "reason": "content-pending",
+    "classifiedAt": "2026-09-07T14:11:37.412Z"
+  }
+}

package/rcf/requirements/req-074.json

@@ -0,0 +1,18 @@
+{
+  "createdAt": "2026-09-07T14:11:37.592Z",
+  "updatedAt": "2026-09-07T14:13:26.508Z",
+  "reqId": "REQ-074",
+  "prdId": "PRD-001",
+  "title": "T-3 hibernatable WebSocket hub accepts clients via state.acceptWebSocket and the wake handler runs from cold reading the same storage",
+  "description": "T-3 hibernatable WebSocket hub: a named HubObject accepts websocket clients via state.acceptWebSocket, routes each webSocketMessage by JSON type field, and broadcasts to all connected sockets. Storage persists the last broadcast so a re-emerging client can catch up; on hibernate-and-wake the wake handler runs from a cold start, reads the same storage, and emits doWakeUp exactly once (idempotent-by-contract per ADR-3405) (AC-33105-1, AC-33110-1).",
+  "category": "functional",
+  "domain": "platform",
+  "priority": "must",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [],
+    "reason": "content-pending",
+    "classifiedAt": "2026-09-07T14:11:37.625Z"
+  }
+}

package/rcf/requirements/req-075.json

@@ -0,0 +1,18 @@
+{
+  "createdAt": "2026-09-07T14:11:37.805Z",
+  "updatedAt": "2026-09-07T14:13:26.508Z",
+  "reqId": "REQ-075",
+  "prdId": "PRD-001",
+  "title": "T-3 lifecycle events fire at namespace and object level with metadata-only payloads",
+  "description": "T-3 lifecycle events: the facade and both DO classes emit metadata-only records on the injected event sink: namespaceReady (facade), doAccept, doAlarmFired, doWakeUp, doHibernate (object). Every record carries only allowed keys drawn from {event, key, size, ttl, timestamp, objectName, scheduledTime}; no message payloads, request bodies or PII cross the sink. The event-secrecy result on the websocket-hub-broadcast probe (AC-33106-1) covers the metadata-only contract on the shipped path.",
+  "category": "functional",
+  "domain": "platform",
+  "priority": "must",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [],
+    "reason": "content-pending",
+    "classifiedAt": "2026-09-07T14:11:37.838Z"
+  }
+}

package/rcf/requirements/req-076.json

@@ -0,0 +1,18 @@
+{
+  "createdAt": "2026-09-07T14:11:38.018Z",
+  "updatedAt": "2026-09-07T14:13:26.508Z",
+  "reqId": "REQ-076",
+  "prdId": "PRD-001",
+  "title": "T-3 sole-reader guarantee enforced by AST scan: no non-facade module imports env.CELL or env.HUB",
+  "description": "T-3 sole-reader guarantee: the shipped sole-reader-scan probe reads every .mjs/.js/.ts file under the fixture's applied source root, strips block and line comments, and matches literal occurrences of env.CELL and env.HUB against the file path. The clean-fixture pass asserts src/do-facade.mjs is the ONLY file whose live source matches; any other file with a live match is a leak returned as fail (AC-33107-1).",
+  "category": "functional",
+  "domain": "platform",
+  "priority": "must",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [],
+    "reason": "content-pending",
+    "classifiedAt": "2026-09-07T14:11:38.051Z"
+  }
+}

package/rcf/requirements/req-077.json

@@ -0,0 +1,18 @@
+{
+  "createdAt": "2026-09-07T14:11:38.243Z",
+  "updatedAt": "2026-09-07T14:13:26.508Z",
+  "reqId": "REQ-077",
+  "prdId": "PRD-001",
+  "title": "T-3 migration-safe class exports: stable class names committed to wrangler with a paired [[migrations]] block",
+  "description": "T-3 migration-safe class exports: the DO class names are stable strings committed under [[durable_objects.bindings]] blocks in wrangler.toml, and a paired [[migrations]] block records the mint classes under tag \"v1\" per Cloudflare's migration documentation. A rename ships as a subsequent migrations tag; a rename without one is a runtime error the anatomy assertion catches at self-review (AC-33108-1).",
+  "category": "functional",
+  "domain": "platform",
+  "priority": "must",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [],
+    "reason": "content-pending",
+    "classifiedAt": "2026-09-07T14:11:38.275Z"
+  }
+}

package/rcf/requirements/req-080.json

@@ -0,0 +1,18 @@
+{
+  "createdAt": "2026-09-07T16:49:01.509Z",
+  "updatedAt": "2026-09-07T17:14:19.059Z",
+  "reqId": "REQ-080",
+  "prdId": "PRD-001",
+  "title": "T-4 edge-cloudflare-access v1.0.0 blueprint: the Access JWT validator is the sole reader of the Cf-Access-Jwt-Assertion header and reduces principal onto request.auth",
+  "description": "The applying Workers project reaches Cloudflare Access through a single JWT validator module (src/jwt-validator.mjs) that is the ONLY module dereferencing the Cf-Access-Jwt-Assertion header. The validator fetches the JWKS from the elicited endpoint, caches keys per-kid, verifies the JWT and reduces the principal into request.auth as {email, sub, groups}. Chain: HQ round-6 T-4 reserved-block per HQ chain-block ruling 2026-09-07 (REQ-080..089 / US-80xx..89xx / TS-110..119 / FBS-100..109 / CN-320..349).",
+  "category": "functional",
+  "domain": "functional",
+  "priority": "must",
+  "version": "1.0.0",
+  "status": "approved",
+  "shapeClassification": {
+    "shapes": [],
+    "reason": "content-pending",
+    "classifiedAt": "2026-09-07T16:49:01.543Z"
+  }
+}

package/rcf/requirements/req-081.json

@@ -0,0 +1,18 @@
+{
+  "createdAt": "2026-09-07T16:49:11.871Z",
+  "updatedAt": "2026-09-07T17:14:19.252Z",
+  "reqId": "REQ-081",
+  "prdId": "PRD-001",
+  "title": "T-4 edge-cloudflare-access v1.0.0: an Access application is declared with an elicited hostname or self-hosted-app id and an elicited policy shape from the enum",
+  "description": "The blueprint elicits either an Access application hostname or a self-hosted-app id, plus the JWT audience, JWKS URL and a policy shape from the enum. Applying the blueprint records the values on rcf/blueprints/edge-cloudflare-access.applied.json.",
+  "category": "functional",
+  "domain": "functional",
+  "priority": "must",
+  "version": "1.0.0",
+  "status": "approved",
+  "shapeClassification": {
+    "shapes": [],
+    "reason": "content-pending",
+    "classifiedAt": "2026-09-07T16:49:11.906Z"
+  }
+}