rcf-lite 0.23.0 → 0.24.0

package/rcf/requirements/req-082.json

@@ -0,0 +1,18 @@
+{
+  "createdAt": "2026-09-07T16:49:12.089Z",
+  "updatedAt": "2026-09-07T17:14:19.438Z",
+  "reqId": "REQ-082",
+  "prdId": "PRD-001",
+  "title": "T-4 edge-cloudflare-access v1.0.0: the operator issues a Zero Trust policy via the dashboard or the API path documented in the guide",
+  "description": "The shipped guide documents two paths for issuing the Zero Trust policy: a dashboard walk-through screen-by-screen and a curl example against api.cloudflare.com/client/v4/accounts/{account_id}/access/apps/{app_id}/policies per https://developers.cloudflare.com/cloudflare-one/policies/access/.",
+  "category": "functional",
+  "domain": "functional",
+  "priority": "must",
+  "version": "1.0.0",
+  "status": "approved",
+  "shapeClassification": {
+    "shapes": [],
+    "reason": "content-pending",
+    "classifiedAt": "2026-09-07T16:49:12.123Z"
+  }
+}

package/rcf/requirements/req-083.json

@@ -0,0 +1,18 @@
+{
+  "createdAt": "2026-09-07T16:49:12.304Z",
+  "updatedAt": "2026-09-07T17:14:19.647Z",
+  "reqId": "REQ-083",
+  "prdId": "PRD-001",
+  "title": "T-4 edge-cloudflare-access v1.0.0: the audit event carries metadata-only fields email, outcome, timestamp and path with no token value or headers",
+  "description": "Every validate outcome emits one audit event on the injected sink with the metadata-only shape {email, outcome, timestamp, path}. The record is Object.frozen at the boundary; no downstream module can enrich it with a stray token slice.",
+  "category": "functional",
+  "domain": "functional",
+  "priority": "must",
+  "version": "1.0.0",
+  "status": "approved",
+  "shapeClassification": {
+    "shapes": [],
+    "reason": "content-pending",
+    "classifiedAt": "2026-09-07T16:49:12.339Z"
+  }
+}

package/rcf/requirements/req-084.json

@@ -0,0 +1,18 @@
+{
+  "createdAt": "2026-09-07T16:49:12.520Z",
+  "updatedAt": "2026-09-07T17:14:19.838Z",
+  "reqId": "REQ-084",
+  "prdId": "PRD-001",
+  "title": "T-4 edge-cloudflare-access v1.0.0: break-glass posture with an elicited bypass-service-auth token pair for CI-signed automation",
+  "description": "The operator elicits a break-glass service-auth id; the paired secret is delegated to the applied secretsManagement companion. Requests presenting the paired CF-Access-Client-Id and CF-Access-Client-Secret headers authenticate with outcome=bypass.",
+  "category": "functional",
+  "domain": "functional",
+  "priority": "must",
+  "version": "1.0.0",
+  "status": "approved",
+  "shapeClassification": {
+    "shapes": [],
+    "reason": "content-pending",
+    "classifiedAt": "2026-09-07T16:49:12.555Z"
+  }
+}

package/rcf/requirements/req-085.json

@@ -0,0 +1,18 @@
+{
+  "createdAt": "2026-09-07T16:49:12.737Z",
+  "updatedAt": "2026-09-07T17:14:20.026Z",
+  "reqId": "REQ-085",
+  "prdId": "PRD-001",
+  "title": "T-4 edge-cloudflare-access v1.0.0: the composition with application-admin-console flips the sign-in surface when the applied capability set contains zeroTrustGate",
+  "description": "When application-admin-console v1.1.0 is applied alongside edge-cloudflare-access, the admin-console reads appliedCapabilities via readAppliedCapabilities() at apply-time and flips its sign-in surface between Access-gated and local-login.",
+  "category": "functional",
+  "domain": "functional",
+  "priority": "must",
+  "version": "1.0.0",
+  "status": "approved",
+  "shapeClassification": {
+    "shapes": [],
+    "reason": "content-pending",
+    "classifiedAt": "2026-09-07T16:49:12.772Z"
+  }
+}

package/rcf/requirements/req-086.json

@@ -0,0 +1,18 @@
+{
+  "createdAt": "2026-09-07T16:49:12.954Z",
+  "updatedAt": "2026-09-07T17:14:20.211Z",
+  "reqId": "REQ-086",
+  "prdId": "PRD-001",
+  "title": "T-4 application-admin-console v1.1.0 minor: consume zeroTrustGate optionally, replacing the local sign-in form with an Access-gated surface when the capability is applied",
+  "description": "application-admin-console v1.1.0 additive minor: consumes zeroTrustGate optionally, replacing the local sign-in form with an Access-gated surface when the capability is applied. Q4 default: consumption is OPTIONAL; principalDirectory remains the sole hard requirement (making Access-gate hard is a v2.0 change).",
+  "category": "functional",
+  "domain": "functional",
+  "priority": "must",
+  "version": "1.0.0",
+  "status": "approved",
+  "shapeClassification": {
+    "shapes": [],
+    "reason": "content-pending",
+    "classifiedAt": "2026-09-07T16:49:12.990Z"
+  }
+}

package/rcf/requirements/req-090.json

@@ -0,0 +1,44 @@
+{
+  "createdAt": "2026-09-07T19:54:00.724Z",
+  "updatedAt": "2026-09-07T20:18:17.227Z",
+  "description": "The applying project reaches Cloudflare Turnstile through a client widget mount that renders on elicited surfaces using the elicited TURNSTILE_SITEKEY. The mount injects only Cloudflare Turnstile JS (challenges.cloudflare.com/turnstile/v0/api.js) and no other third-party script. On submit the widget populates a hidden Cf-Turnstile-Response token field in the form payload. Chain: HQ round-6 T-5 reserved-block per HQ chain-block ruling 2026-09-07 (REQ-090..099 / US-90xx..94xx / TS-120..129 / FBS-110..119 / CN-350..379).",
+  "reqId": "REQ-090",
+  "prdId": "PRD-001",
+  "title": "T-5 edge-cloudflare-turnstile v1.0.0 blueprint: the Turnstile client widget mounts with an elicited sitekey and injects no third-party script beyond Cloudflare Turnstile JS host",
+  "category": "functional",
+  "domain": "functional",
+  "priority": "must",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [
+      "webUi",
+      "httpApi",
+      "auth"
+    ],
+    "reason": "keyword-scan",
+    "classifiedAt": "2026-09-07T19:54:00.763Z",
+    "signals": [
+      {
+        "source": "description",
+        "shape": "webUi",
+        "match": "renders"
+      },
+      {
+        "source": "description",
+        "shape": "httpApi",
+        "match": "api"
+      },
+      {
+        "source": "description",
+        "shape": "auth",
+        "match": "token"
+      },
+      {
+        "source": "description",
+        "shape": "webUi",
+        "match": "form"
+      }
+    ]
+  }
+}

package/rcf/requirements/req-091.json

@@ -0,0 +1,53 @@
+{
+  "createdAt": "2026-09-07T19:54:00.947Z",
+  "updatedAt": "2026-09-07T20:18:17.412Z",
+  "description": "The applying project verifies every Turnstile response token server-side by POSTing {secret: TURNSTILE_SECRET, response: <token>} to https://challenges.cloudflare.com/turnstile/v0/siteverify per Cloudflare Turnstile documented endpoint. On success:true the handler proceeds; on success:false the handler rejects with 400 and the refusal body carries the error-codes[] value, not the sitekey or secret.",
+  "reqId": "REQ-091",
+  "prdId": "PRD-001",
+  "title": "T-5 edge-cloudflare-turnstile v1.0.0: server-side siteverify POSTs the response token to challenges.cloudflare.com/turnstile/v0/siteverify with the elicited secret",
+  "category": "functional",
+  "domain": "functional",
+  "priority": "must",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [
+      "httpApi",
+      "auth"
+    ],
+    "reason": "keyword-scan",
+    "classifiedAt": "2026-09-07T19:54:00.984Z",
+    "signals": [
+      {
+        "source": "title",
+        "shape": "httpApi",
+        "match": "POST"
+      },
+      {
+        "source": "title",
+        "shape": "auth",
+        "match": "token"
+      },
+      {
+        "source": "description",
+        "shape": "auth",
+        "match": "token"
+      },
+      {
+        "source": "description",
+        "shape": "httpApi",
+        "match": "POST"
+      },
+      {
+        "source": "description",
+        "shape": "auth",
+        "match": "token"
+      },
+      {
+        "source": "description",
+        "shape": "httpApi",
+        "match": "endpoint"
+      }
+    ]
+  }
+}

package/rcf/requirements/req-092.json

@@ -0,0 +1,32 @@
+{
+  "createdAt": "2026-09-07T19:54:01.170Z",
+  "updatedAt": "2026-09-07T20:18:17.597Z",
+  "description": "The applying project registers a token-required guard at every elicited surface. A submit whose payload lacks the Cf-Turnstile-Response field is rejected with 400 before any downstream handler runs. The refusal body carries a stable error-code, not the sitekey.",
+  "reqId": "REQ-092",
+  "prdId": "PRD-001",
+  "title": "T-5 edge-cloudflare-turnstile v1.0.0: refuse-if-token-missing guard on elicited surfaces rejects submit with 400 before any downstream logic",
+  "category": "functional",
+  "domain": "functional",
+  "priority": "must",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [
+      "auth"
+    ],
+    "reason": "keyword-scan",
+    "classifiedAt": "2026-09-07T19:54:01.209Z",
+    "signals": [
+      {
+        "source": "title",
+        "shape": "auth",
+        "match": "token"
+      },
+      {
+        "source": "description",
+        "shape": "auth",
+        "match": "token"
+      }
+    ]
+  }
+}

package/rcf/requirements/req-093.json

@@ -0,0 +1,52 @@
+{
+  "createdAt": "2026-09-07T19:54:01.402Z",
+  "updatedAt": "2026-09-07T20:18:17.783Z",
+  "description": "When both security-auth-magic-link and edge-cloudflare-turnstile are applied, the magic-link mint surface reads through the Turnstile guard: a mint submit without a valid Turnstile response is refused with 400 before the mint fires. Composition uses the TAC-3603 hook on the shipped magic-link mint surface.",
+  "reqId": "REQ-093",
+  "prdId": "PRD-001",
+  "title": "T-5 edge-cloudflare-turnstile v1.0.0: composition with security-auth-magic-link refuses magic-link mint without a valid Turnstile token",
+  "category": "functional",
+  "domain": "functional",
+  "priority": "must",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [
+      "auth"
+    ],
+    "reason": "keyword-scan",
+    "classifiedAt": "2026-09-07T19:54:01.439Z",
+    "signals": [
+      {
+        "source": "title",
+        "shape": "auth",
+        "match": "magic-link"
+      },
+      {
+        "source": "title",
+        "shape": "auth",
+        "match": "magic-link"
+      },
+      {
+        "source": "title",
+        "shape": "auth",
+        "match": "token"
+      },
+      {
+        "source": "description",
+        "shape": "auth",
+        "match": "magic-link"
+      },
+      {
+        "source": "description",
+        "shape": "auth",
+        "match": "magic-link"
+      },
+      {
+        "source": "description",
+        "shape": "auth",
+        "match": "magic-link"
+      }
+    ]
+  }
+}

package/rcf/requirements/req-094.json

@@ -0,0 +1,32 @@
+{
+  "createdAt": "2026-09-07T19:54:01.626Z",
+  "updatedAt": "2026-09-07T20:18:17.970Z",
+  "description": "The applying operator elicits one of Cloudflare Turnstile documented widget modes: managed (default; renders challenge only when Cloudflare deems it necessary), non-interactive (always renders a non-interactive challenge) or invisible (mounts an invisible widget). The default mode is managed per the shipped ADR.",
+  "reqId": "REQ-094",
+  "prdId": "PRD-001",
+  "title": "T-5 edge-cloudflare-turnstile v1.0.0: widget mode is an elicited enum (managed, non-interactive, invisible) per Cloudflare documented modes; recommendedDefault is managed",
+  "category": "functional",
+  "domain": "functional",
+  "priority": "must",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [
+      "webUi"
+    ],
+    "reason": "keyword-scan",
+    "classifiedAt": "2026-09-07T19:54:01.664Z",
+    "signals": [
+      {
+        "source": "description",
+        "shape": "webUi",
+        "match": "renders"
+      },
+      {
+        "source": "description",
+        "shape": "webUi",
+        "match": "renders"
+      }
+    ]
+  }
+}

package/rcf/requirements/req-100.json

@@ -0,0 +1,13 @@
+{
+  "createdAt": "2026-09-07T21:38:51.465Z",
+  "updatedAt": "2026-09-07T23:05:23.440Z",
+  "description": "The applying project holds its rate-limit rule set as a set of JSON documents under the elicited rate-limit-rules-dir (default cloudflare/rate-limits/), one file per rule per ADR-3703. Every manifest file declares the seven documented fields the Cloudflare WAF rate-limiting rules contract names per https://developers.cloudflare.com/waf/rate-limiting-rules/: id, expression, threshold, period, characteristics, action, duration. The zone id is elicited and stored via secretsManagement; no rule references a secret in plaintext. Chain: HQ round-6 T-6 reserved-block per HQ chain-block ruling 2026-09-07 (REQ-100..109 / TS-130..139 / FBS-120..129 / CN-380..409). Round-6 T-6 track of Cloudflare-round-6-spec-2026-09-06 section 5.6.",
+  "reqId": "REQ-100",
+  "prdId": "PRD-001",
+  "title": "T-6 edge-cloudflare-rate-limiting v1.0.0 blueprint: rate-limit rule manifest committed under cloudflare/rate-limits/, one JSON file per rule, matching the elicited rule shape without plaintext secrets",
+  "category": "functional",
+  "domain": "functional",
+  "priority": "must",
+  "version": "0.1.0",
+  "status": "draft"
+}

package/rcf/requirements/req-101.json

@@ -0,0 +1,13 @@
+{
+  "createdAt": "2026-09-07T21:38:51.792Z",
+  "updatedAt": "2026-09-07T23:05:23.637Z",
+  "description": "The blueprint ships no committed script that writes rules to the live Cloudflare zone. The applying project's operator applies each rule via a documented wrangler command flow or a Cloudflare dashboard flow per TAC-3702 and the guide. The elicited rate-limit-management-surface value records the flow the operator chose; the guide covers both. Chain: HQ round-6 T-6 reserved-block per HQ chain-block ruling 2026-09-07.",
+  "reqId": "REQ-101",
+  "prdId": "PRD-001",
+  "title": "T-6 edge-cloudflare-rate-limiting v1.0.0 blueprint: operator-facing management surface documented as a wrangler command flow or Cloudflare dashboard flow the operator applies from the manifest",
+  "category": "functional",
+  "domain": "functional",
+  "priority": "must",
+  "version": "0.1.0",
+  "status": "draft"
+}

package/rcf/requirements/req-102.json

@@ -0,0 +1,13 @@
+{
+  "createdAt": "2026-09-07T21:38:52.126Z",
+  "updatedAt": "2026-09-07T23:05:23.824Z",
+  "description": "Given a rule that permits N requests per period on a characteristic set, when a client sends the (N+1)th request within that period, Cloudflare refuses the request at the edge for the elicited duration. The refusal response is HTTP 429 with a Retry-After header consistent with the elicited duration and a Cf-Ray header identifying the CF edge per https://developers.cloudflare.com/waf/rate-limiting-rules/. The origin Worker never sees the refused requests. Chain: HQ round-6 T-6 reserved-block per HQ chain-block ruling 2026-09-07.",
+  "reqId": "REQ-102",
+  "prdId": "PRD-001",
+  "title": "T-6 edge-cloudflare-rate-limiting v1.0.0 blueprint: over-threshold behaviour returns 429 with Retry-After and Cf-Ray for the (N+1)th and subsequent requests within the elicited duration",
+  "category": "functional",
+  "domain": "functional",
+  "priority": "must",
+  "version": "0.1.0",
+  "status": "draft"
+}

package/rcf/requirements/req-103.json

@@ -0,0 +1,13 @@
+{
+  "createdAt": "2026-09-07T21:38:52.452Z",
+  "updatedAt": "2026-09-07T23:05:24.011Z",
+  "description": "The blueprint ships a scheduled drift-audit runner (TAC-3703) the applying project can wire behind the elicited rate-limit-drift-audit-cadence per ADR-3704. When enabled, the runner fetches the live rate-limiting rules on the elicited zone via the Cloudflare API, diffs against the local manifest, and constructs one drift-audit record per mismatched rule. Records write through the applied logger with the metadata-only shape {ruleId, clientIpHash, outcome, timestamp, diff}; no record carries a full IP, a request body or a user agent. Chain: HQ round-6 T-6 reserved-block per HQ chain-block ruling 2026-09-07.",
+  "reqId": "REQ-103",
+  "prdId": "PRD-001",
+  "title": "T-6 edge-cloudflare-rate-limiting v1.0.0 blueprint: drift-audit runner reads live zone rules via the Cloudflare API and diffs against the local manifest, constructing metadata-only records",
+  "category": "functional",
+  "domain": "functional",
+  "priority": "must",
+  "version": "0.1.0",
+  "status": "draft"
+}

package/rcf/requirements/req-104.json

@@ -0,0 +1,13 @@
+{
+  "createdAt": "2026-09-07T21:38:52.795Z",
+  "updatedAt": "2026-09-07T23:05:24.201Z",
+  "description": "When both edge-cloudflare-rate-limiting and security-auth-magic-link are applied on the same project, the zone-level rate rule sits at the CF edge and refuses the (N+1)th request for the elicited duration before it reaches the origin; the security-auth-magic-link per-email application rate limiter continues to run at the mint-surface. The two rules operate on different characteristic sets (IP-per-URL vs per-email per-minute) and are additive. ADR-3702 records the layering. Chain: HQ round-6 T-6 reserved-block per HQ chain-block ruling 2026-09-07.",
+  "reqId": "REQ-104",
+  "prdId": "PRD-001",
+  "title": "T-6 edge-cloudflare-rate-limiting v1.0.0 blueprint: composition with security-auth-magic-link layers the zone rule over the per-email application rule per ADR-3702",
+  "category": "functional",
+  "domain": "functional",
+  "priority": "must",
+  "version": "0.1.0",
+  "status": "draft"
+}

package/rcf/tacs/tac-2214-application-admin-console-access-gated-signin-surface.json

@@ -0,0 +1,15 @@
+{
+  "createdAt": "2026-09-07T16:53:45.406Z",
+  "updatedAt": "2026-09-07T17:03:10.394Z",
+  "tacId": "TAC-2214-application-admin-console-access-gated-signin-surface",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "purpose": "Access-gated sign-in surface for application-admin-console v1.1.0: no local form, principal-read from request.auth via [data-role=principal-read]; falls back to local-login when zeroTrustGate absent.",
+  "responsibilities": [
+    "Realise the shape named in the purpose statement.",
+    "Bind the anchored ACs on the shipped probes and the extended admin-console pack."
+  ],
+  "name": "Access-gated sign-in surface shape with principal-read-from-request contract"
+}

package/rcf/tacs/tac-3501-edge-cloudflare-access-jwt-validator.json

@@ -0,0 +1,15 @@
+{
+  "createdAt": "2026-09-07T16:53:43.928Z",
+  "updatedAt": "2026-09-07T17:03:09.639Z",
+  "tacId": "TAC-3501-edge-cloudflare-access-jwt-validator",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "purpose": "Access JWT validator module; sole reader of the Cf-Access-Jwt-Assertion header; JWKS fetch cached per kid; principal reduces to {email, sub, groups}.",
+  "responsibilities": [
+    "Realise the shape named in the purpose statement.",
+    "Bind the anchored ACs on the shipped probes and the extended admin-console pack."
+  ],
+  "name": "Access JWT validator with JWKS fetch and cache"
+}

package/rcf/tacs/tac-3502-edge-cloudflare-access-application-declaration.json

@@ -0,0 +1,15 @@
+{
+  "createdAt": "2026-09-07T16:53:44.112Z",
+  "updatedAt": "2026-09-07T17:03:09.831Z",
+  "tacId": "TAC-3502-edge-cloudflare-access-application-declaration",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "purpose": "Access application declaration surface: elicited hostname or self-hosted-app id plus JWT audience, JWKS URL, policy shape and optional break-glass service-auth pair; recorded on the applied-sidecar.",
+  "responsibilities": [
+    "Realise the shape named in the purpose statement.",
+    "Bind the anchored ACs on the shipped probes and the extended admin-console pack."
+  ],
+  "name": "Access application declaration surface"
+}

package/rcf/tacs/tac-3503-edge-cloudflare-access-policy-shape.json

@@ -0,0 +1,15 @@
+{
+  "createdAt": "2026-09-07T16:53:44.296Z",
+  "updatedAt": "2026-09-07T17:03:10.018Z",
+  "tacId": "TAC-3503-edge-cloudflare-access-policy-shape",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "purpose": "Access policy shape enum with four values: email-domain, service-token-only, service-token-plus-email-domain, group-membership; drives the guide walk-through and the API alternative.",
+  "responsibilities": [
+    "Realise the shape named in the purpose statement.",
+    "Bind the anchored ACs on the shipped probes and the extended admin-console pack."
+  ],
+  "name": "Access policy shape enum and its issuance flow"
+}

package/rcf/tacs/tac-3504-edge-cloudflare-access-audit-sink.json

@@ -0,0 +1,15 @@
+{
+  "createdAt": "2026-09-07T16:53:44.481Z",
+  "updatedAt": "2026-09-07T17:03:10.205Z",
+  "tacId": "TAC-3504-edge-cloudflare-access-audit-sink",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "purpose": "Access audit sink contract: metadata-only shape {email, outcome, timestamp, path}; frozen at the validator boundary; retention delegated to the applied logging companion.",
+  "responsibilities": [
+    "Realise the shape named in the purpose statement.",
+    "Bind the anchored ACs on the shipped probes and the extended admin-console pack."
+  ],
+  "name": "Access audit sink with metadata-only shape"
+}

package/rcf/tacs/tac-3601-edge-cloudflare-turnstile-widget-mount.json

@@ -0,0 +1,15 @@
+{
+  "createdAt": "2026-09-07T19:56:37.865Z",
+  "updatedAt": "2026-09-07T19:56:37.865Z",
+  "purpose": "Turnstile client widget mount module; injects only Cloudflare Turnstile JS (challenges.cloudflare.com); renders with the elicited TURNSTILE_SITEKEY; populates the hidden Cf-Turnstile-Response token field on submit.",
+  "responsibilities": [
+    "Realise the shape named in the purpose statement.",
+    "Bind the anchored ACs on the shipped probes and the Playwright pack."
+  ],
+  "tacId": "TAC-3601-edge-cloudflare-turnstile-widget-mount",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "draft",
+  "name": "Turnstile client widget mount with elicited sitekey and third-party script pin"
+}

package/rcf/tacs/tac-3602-edge-cloudflare-turnstile-server-verifier.json

@@ -0,0 +1,15 @@
+{
+  "createdAt": "2026-09-07T19:56:38.049Z",
+  "updatedAt": "2026-09-07T19:56:38.049Z",
+  "purpose": "Turnstile server-side siteverify verifier; POSTs {secret, response} to https://challenges.cloudflare.com/turnstile/v0/siteverify; on success:true proceeds, on success:false rejects 400 with error-codes body; token-required guard rejects missing-token submits with 400 before any downstream handler runs.",
+  "responsibilities": [
+    "Realise the shape named in the purpose statement.",
+    "Bind the anchored ACs on the shipped probes and the Playwright pack."
+  ],
+  "tacId": "TAC-3602-edge-cloudflare-turnstile-server-verifier",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "draft",
+  "name": "Turnstile server-side siteverify verifier and refuse-if-token-missing guard"
+}

package/rcf/tacs/tac-3603-edge-cloudflare-turnstile-magic-link-hook.json

@@ -0,0 +1,15 @@
+{
+  "createdAt": "2026-09-07T19:56:38.233Z",
+  "updatedAt": "2026-09-07T19:56:38.233Z",
+  "purpose": "Composition hook on the security-auth-magic-link mint surface: the magic-link mint route reads through the Turnstile guard before invoking the mint; a missing or failed Turnstile token refuses the mint with 400.",
+  "responsibilities": [
+    "Realise the shape named in the purpose statement.",
+    "Bind the anchored ACs on the shipped probes and the Playwright pack."
+  ],
+  "tacId": "TAC-3603-edge-cloudflare-turnstile-magic-link-hook",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "draft",
+  "name": "Composition hook into security-auth-magic-link mint surface"
+}

package/rcf/tacs/tac-3701-edge-cloudflare-rate-limiting-manifest-schema.json

@@ -0,0 +1,16 @@
+{
+  "createdAt": "2026-09-07T21:40:45.360Z",
+  "updatedAt": "2026-09-07T21:40:45.360Z",
+  "purpose": "T-6 repo-chain TAC mirror for the shipped blueprints/edge-cloudflare-rate-limiting/contributions/tacs/tac-3701-edge-cloudflare-rate-limiting-manifest-schema.json contribution. Defines the JSON Schema shape and the manifest directory layout for the local rate-limit rules manifest per https://developers.cloudflare.com/waf/rate-limiting-rules/. Anchors AC-10001-1, AC-10601-1, AC-10801-1 (and AC-36101-1, AC-36106-1, AC-36108-1 on the shipped blueprint).",
+  "internalStructure": "One JSON Schema file at blueprints/edge-cloudflare-rate-limiting/contributions/schemas/rate-limit-rule.schema.json (draft-07); one shipped example manifest directory in the cf-edge fixture with two files.",
+  "responsibilities": [
+    "Ship a draft-07 JSON Schema for the rate-limit rule manifest file (AC-10001-1, AC-10601-1).",
+    "Ship the layout the manifest-presence probe scans (AC-10001-1, AC-10801-1)."
+  ],
+  "tacId": "TAC-3701-edge-cloudflare-rate-limiting-manifest-schema",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "draft",
+  "name": "Rate-limit rule manifest schema and manifest layout"
+}

package/rcf/tacs/tac-3702-edge-cloudflare-rate-limiting-management-surface-doc.json

@@ -0,0 +1,15 @@
+{
+  "createdAt": "2026-09-07T21:40:45.647Z",
+  "updatedAt": "2026-09-07T21:40:45.647Z",
+  "purpose": "T-6 repo-chain TAC mirror for the shipped blueprints/edge-cloudflare-rate-limiting/contributions/tacs/tac-3702-edge-cloudflare-rate-limiting-management-surface-doc.json contribution. Defines the operator-facing management surface documentation shape: both a wrangler command flow and a Cloudflare dashboard flow for applying one rule from a manifest file to the elicited zone. Anchors AC-10101-1 and AC-10401-1.",
+  "internalStructure": "One guide file at blueprints/edge-cloudflare-rate-limiting/guide/edge-cloudflare-rate-limiting.md with three named sections: Manifest, Management surface (wrangler and dashboard subsections), Composition with security-auth-magic-link.",
+  "responsibilities": [
+    "Ship the guide with both wrangler and dashboard flows plus the composition example (AC-10101-1, AC-10401-1)."
+  ],
+  "tacId": "TAC-3702-edge-cloudflare-rate-limiting-management-surface-doc",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "draft",
+  "name": "Operator-facing management surface documentation (wrangler and dashboard flows)"
+}

package/rcf/tacs/tac-3703-edge-cloudflare-rate-limiting-drift-audit-runner.json

@@ -0,0 +1,16 @@
+{
+  "createdAt": "2026-09-07T21:40:45.943Z",
+  "updatedAt": "2026-09-07T21:40:45.943Z",
+  "purpose": "T-6 repo-chain TAC mirror for the shipped blueprints/edge-cloudflare-rate-limiting/contributions/tacs/tac-3703-edge-cloudflare-rate-limiting-drift-audit-runner.json contribution. Defines the drift-audit runner: factory shape createDriftAuditRunner({env, eventSink, fetch, clock, cadence, manifestLoader}) that fetches live rules via the Cloudflare API and diffs against the local manifest, constructing metadata-only drift records. Anchors AC-10301-1 and AC-10701-1.",
+  "internalStructure": "One runner module realised in the cf-edge fixture at packages/rcf-lite/test/fixtures/cf-edge/src/drift-audit-runner.mjs. The applying project copies the shape from the blueprint guide; the fixture module is the shape probes drive.",
+  "responsibilities": [
+    "Ship the drift-audit runner factory (AC-10301-1).",
+    "Emit metadata-only audit records via the injected sink, Object.frozen at the boundary (AC-10701-1)."
+  ],
+  "tacId": "TAC-3703-edge-cloudflare-rate-limiting-drift-audit-runner",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "draft",
+  "name": "Drift-audit runner: read live zone rules via the Cloudflare API and diff against the local manifest"
+}