rcf-lite 0.23.0 → 0.24.0

package/rcf/test-suites/ts-136.json

@@ -0,0 +1,22 @@
+{
+  "createdAt": "2026-09-07T21:41:31.243Z",
+  "updatedAt": "2026-09-07T21:41:31.532Z",
+  "purpose": "Cover AC-10701-1 via the T-6 anatomy test in test/blueprint/edge-cloudflare-rate-limiting-anatomy.test.js.",
+  "testLevel": "integration",
+  "acIds": [
+    "AC-10701-1"
+  ],
+  "id": "TS-136",
+  "usId": "US-10701",
+  "title": "T-6 AC-10701-1 anatomy proof",
+  "testCases": [
+    {
+      "id": "TC-136-event-secrecy-pass-and-leak",
+      "acId": "AC-10701-1",
+      "description": "AC-10701-1 anatomy proof (T-6 rate-limiting slice, TC-136-event-secrecy-pass-and-leak)",
+      "status": "pending",
+      "testPointer": "test/blueprint/edge-cloudflare-rate-limiting-anatomy.test.js::T-6 rate-limiting AC-10701-1 anatomy proof (TC-136-event-secrecy-pass-and-leak)"
+    }
+  ],
+  "status": "draft"
+}

package/rcf/test-suites/ts-137.json

@@ -0,0 +1,22 @@
+{
+  "createdAt": "2026-09-07T21:41:31.821Z",
+  "updatedAt": "2026-09-07T21:41:32.111Z",
+  "purpose": "Cover AC-10801-1 via the T-6 anatomy test in test/blueprint/edge-cloudflare-rate-limiting-anatomy.test.js.",
+  "testLevel": "integration",
+  "acIds": [
+    "AC-10801-1"
+  ],
+  "id": "TS-137",
+  "usId": "US-10801",
+  "title": "T-6 AC-10801-1 anatomy proof",
+  "testCases": [
+    {
+      "id": "TC-137-manifest-presence-missing-fail",
+      "acId": "AC-10801-1",
+      "description": "AC-10801-1 anatomy proof (T-6 rate-limiting slice, TC-137-manifest-presence-missing-fail)",
+      "status": "pending",
+      "testPointer": "test/blueprint/edge-cloudflare-rate-limiting-anatomy.test.js::T-6 rate-limiting AC-10801-1 anatomy proof (TC-137-manifest-presence-missing-fail)"
+    }
+  ],
+  "status": "draft"
+}

package/rcf/user-stories/us-10001.json

@@ -0,0 +1,23 @@
+{
+  "createdAt": "2026-09-07T21:41:02.422Z",
+  "updatedAt": "2026-09-07T21:41:02.422Z",
+  "asA": "shelf consumer applying the edge-cloudflare-rate-limiting v1.0.0 blueprint on a Workers project using the cf-edge fixture",
+  "iWant": "the elicited manifest directory to hold at least one committed JSON file per rate-limit rule, each carrying the seven documented fields and no plaintext secret",
+  "soThat": "the rules are source-controlled and reviewable and the operator has a stable source of truth to apply to the live zone",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-10001-1",
+      "description": "The cf-edge fixture's cloudflare/rate-limits/ directory holds at least one JSON file per rule; every file parses; every file carries id, expression, threshold, period, characteristics, action, duration; no file body carries a plaintext bearer token, private key or inline CF_API_TOKEN reference.",
+      "testable": true
+    }
+  ],
+  "tacIds": [
+    "TAC-3701-edge-cloudflare-rate-limiting-manifest-schema"
+  ],
+  "usId": "US-10001",
+  "prdId": "PRD-001",
+  "reqId": "REQ-100",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-6 rate-limit manifest present in cf-edge cloudflare/rate-limits/ carrying seven required fields without plaintext secrets"
+}

package/rcf/user-stories/us-10101.json

@@ -0,0 +1,23 @@
+{
+  "createdAt": "2026-09-07T21:41:02.760Z",
+  "updatedAt": "2026-09-07T21:41:02.760Z",
+  "asA": "operator on the applying project preparing to push rate-limit rules from the local manifest to the live Cloudflare zone",
+  "iWant": "a documented flow with both wrangler command steps and a Cloudflare dashboard walkthrough",
+  "soThat": "I can pick the flow that suits my operating discipline and reproduce the apply from the manifest",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-10101-1",
+      "description": "The blueprint guide documents an operator-facing management surface with a wrangler command flow and a Cloudflare dashboard flow; the guide references https://developers.cloudflare.com/waf/rate-limiting-rules/.",
+      "testable": true
+    }
+  ],
+  "tacIds": [
+    "TAC-3702-edge-cloudflare-rate-limiting-management-surface-doc"
+  ],
+  "usId": "US-10101",
+  "prdId": "PRD-001",
+  "reqId": "REQ-101",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-6 operator-facing management surface: wrangler command flow and Cloudflare dashboard flow documented in the guide"
+}

package/rcf/user-stories/us-10201.json

@@ -0,0 +1,23 @@
+{
+  "createdAt": "2026-09-07T21:41:03.086Z",
+  "updatedAt": "2026-09-07T21:41:03.086Z",
+  "asA": "operator running the real-account burst probe against a scheduled HQ-owned URL",
+  "iWant": "the probe to fire an undici burst above the rule threshold and observe the (N+1)th and subsequent requests return HTTP 429 with Retry-After and Cf-Ray, or record accountBoundSkipped in CI",
+  "soThat": "the over-threshold behaviour is verified against a real Cloudflare account when the account is available, and CI without an account records the honest verdict per ruling 6",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-10201-1",
+      "description": "With CI_HAS_CLOUDFLARE_ACCOUNT=true and CF_RATE_LIMIT_URL set, the burst probe returns 429 with Retry-After and Cf-Ray on over-threshold requests; without either env var it records accountBoundSkipped: true and aggregates to pass per spec section 3.5 and ruling 6.",
+      "testable": true
+    }
+  ],
+  "tacIds": [
+    "TAC-3701-edge-cloudflare-rate-limiting-manifest-schema"
+  ],
+  "usId": "US-10201",
+  "prdId": "PRD-001",
+  "reqId": "REQ-102",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-6 real-account burst returns 429 with Retry-After and Cf-Ray on over-threshold requests, or accountBoundSkipped in CI per ruling 6"
+}

package/rcf/user-stories/us-10301.json

@@ -0,0 +1,23 @@
+{
+  "createdAt": "2026-09-07T21:41:03.411Z",
+  "updatedAt": "2026-09-07T21:41:03.411Z",
+  "asA": "operator on the applying project running the scheduled drift-audit runner behind the elicited cadence",
+  "iWant": "the runner to fetch the live rules via the Cloudflare API and diff each against the local manifest, constructing metadata-only drift records",
+  "soThat": "manifest drift is surfaced through the logging companion rather than lingering unnoticed",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-10301-1",
+      "description": "Given a fixture manifest with threshold 60 and a fake live-zone response with threshold 90 on the same rule id, the runner constructs one drift record with {ruleId, clientIpHash, outcome, timestamp, diff:[{field:threshold, manifestValue:60, liveValue:90}]}; no full IP, body or user-agent field is present.",
+      "testable": true
+    }
+  ],
+  "tacIds": [
+    "TAC-3703-edge-cloudflare-rate-limiting-drift-audit-runner"
+  ],
+  "usId": "US-10301",
+  "prdId": "PRD-001",
+  "reqId": "REQ-103",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-6 drift-audit runner reads live rules and diffs against manifest, constructing metadata-only drift records"
+}

package/rcf/user-stories/us-10401.json

@@ -0,0 +1,23 @@
+{
+  "createdAt": "2026-09-07T21:41:03.736Z",
+  "updatedAt": "2026-09-07T21:41:03.736Z",
+  "asA": "operator applying both edge-cloudflare-rate-limiting and security-auth-magic-link on the same project",
+  "iWant": "the guide to name the ADR-3702 layering explicitly with a copy-paste example",
+  "soThat": "I understand the two-rule shape at apply time rather than by trial and error",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-10401-1",
+      "description": "The guide contains a Composition with security-auth-magic-link section referencing ADR-3702, naming the two characteristic sets (IP-per-URL and per-email per-minute) verbatim, and showing a copy-paste example of both blueprints applied.",
+      "testable": true
+    }
+  ],
+  "tacIds": [
+    "TAC-3702-edge-cloudflare-rate-limiting-management-surface-doc"
+  ],
+  "usId": "US-10401",
+  "prdId": "PRD-001",
+  "reqId": "REQ-104",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-6 composition with security-auth-magic-link: zone rule layers over the per-email application rule per ADR-3702, documented in the guide"
+}

package/rcf/user-stories/us-10601.json

@@ -0,0 +1,23 @@
+{
+  "createdAt": "2026-09-07T21:41:04.062Z",
+  "updatedAt": "2026-09-07T21:41:04.062Z",
+  "asA": "operator committing new rate-limit rule files under the elicited manifest directory",
+  "iWant": "the shipped JSON Schema to validate every rule file and the manifest-schema-validate probe to surface any file that violates the shape",
+  "soThat": "invalid manifest changes are caught in the fixture probe rather than at operator apply time",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-10601-1",
+      "description": "The manifest-schema-validate probe validates every manifest file against the shipped rate-limit-rule.schema.json (draft-07); valid files pass; a manifest file missing threshold (SIMULATE_SCHEMA_INVALID=true) fails validation with the offending field named in the detail.",
+      "testable": true
+    }
+  ],
+  "tacIds": [
+    "TAC-3701-edge-cloudflare-rate-limiting-manifest-schema"
+  ],
+  "usId": "US-10601",
+  "prdId": "PRD-001",
+  "reqId": "REQ-100",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-6 manifest schema validates every rule file against the shipped draft-07 schema and refuses invalid shapes"
+}

package/rcf/user-stories/us-10701.json

@@ -0,0 +1,23 @@
+{
+  "createdAt": "2026-09-07T21:41:04.389Z",
+  "updatedAt": "2026-09-07T21:41:04.389Z",
+  "asA": "operator reading drift-audit reports and rate-limit event records through the applied logging companion",
+  "iWant": "every drift-audit record to carry only metadata-safe fields, never a full IP, request body or user agent string",
+  "soThat": "the audit trail is safe to store, forward and read without additional PII scrubbing",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-10701-1",
+      "description": "The event-secrecy probe drives the drift-audit runner with a synthetic input pair; every record carries only {ruleId, clientIpHash, outcome, timestamp, diff}; SIMULATE_EVENT_LEAK_IP=true injects a full IP into the outcome so the probe surfaces the leak.",
+      "testable": true
+    }
+  ],
+  "tacIds": [
+    "TAC-3703-edge-cloudflare-rate-limiting-drift-audit-runner"
+  ],
+  "usId": "US-10701",
+  "prdId": "PRD-001",
+  "reqId": "REQ-103",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-6 drift-audit event records carry ruleId, clientIpHash, outcome, timestamp, diff only; no full IP, body or user-agent"
+}

package/rcf/user-stories/us-10801.json

@@ -0,0 +1,23 @@
+{
+  "createdAt": "2026-09-07T21:41:04.712Z",
+  "updatedAt": "2026-09-07T21:41:04.712Z",
+  "asA": "operator that accidentally deletes or moves a manifest file",
+  "iWant": "the manifest-presence probe to surface the missing file at fixture probe time",
+  "soThat": "a manifest under-population defect is caught in CI rather than at operator apply time",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-10801-1",
+      "description": "With SIMULATE_MANIFEST_MISSING=true the manifest-presence probe returns aggregateVerdict: fail and names the missing file basename in the detail; without the switch the probe passes.",
+      "testable": true
+    }
+  ],
+  "tacIds": [
+    "TAC-3701-edge-cloudflare-rate-limiting-manifest-schema"
+  ],
+  "usId": "US-10801",
+  "prdId": "PRD-001",
+  "reqId": "REQ-100",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-6 manifest-presence probe refuses a missing manifest file and names the basename in the detail"
+}

package/rcf/user-stories/us-5001.json

@@ -0,0 +1,27 @@
+{
+  "createdAt": "2026-09-07T10:18:40.349Z",
+  "updatedAt": "2026-09-07T10:20:10.276Z",
+  "usId": "US-5001",
+  "prdId": "PRD-001",
+  "reqId": "REQ-050",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-1 KV facade opens against the elicited KV binding on boot and emits facadeReady",
+  "asA": "shelf consumer applying the platform-cloudflare-kv v1.0.0 blueprint on a Workers project using the cf-platform fixture",
+  "iWant": "one KV facade module (src/kv-facade.mjs) that opens against the elicited KV binding on process boot and emits a facadeReady lifecycle event with a metadata-only payload",
+  "soThat": "boot ordering is observable, the ready-check seam is a single call site, and the applied project can compose its own bootstrapping around one predictable event",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-5001-1",
+      "description": "On process boot, the facade opens against the elicited KV binding (env.CACHE on the fixture) with a bounded list(limit:1) ready-check; once the ready-check resolves, a facadeReady event fires on the injected event sink with a payload of exactly {event, key, size, ttl, timestamp} where key is null, size is 0 and ttl is null. The facade exposes typed named domain verbs (get, getWithMetadata, put, delete, list) and does NOT re-export the raw KV binding.",
+      "given": "a Node or Worker process with the facade module imported and its factory invoked with the elicited binding",
+      "when": "the process boots and the facade ready() call resolves",
+      "then": "a facadeReady event fires on the injected event sink with the metadata-only payload; the facade exposes named domain verbs only; the raw binding is not re-exported",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tags": [
+    "blueprint:platform-cloudflare-kv"
+  ]
+}

package/rcf/user-stories/us-5002.json

@@ -0,0 +1,27 @@
+{
+  "createdAt": "2026-09-07T10:18:40.551Z",
+  "updatedAt": "2026-09-07T10:20:10.276Z",
+  "usId": "US-5002",
+  "prdId": "PRD-001",
+  "reqId": "REQ-050",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-1 KV facade module is the sole reader of the KV binding grep-verified on the applied fixture tree",
+  "asA": "shelf consumer applying platform-cloudflare-kv v1.0.0",
+  "iWant": "the KV binding reference (env.CACHE) to appear in exactly one source module (src/kv-facade.mjs)",
+  "soThat": "the vendor surface is diffused across zero call sites outside the facade, and a future adapter swap lands without moving any AC",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-5002-1",
+      "description": "A grep for env.CACHE in the applied fixture src/ tree returns exactly one file: src/kv-facade.mjs. No other module dereferences the raw KV binding. The public surface of src/kv-facade.mjs exports the createKvFacade factory only; the raw env.CACHE reference never crosses the module boundary.",
+      "given": "the applied project source tree after apply",
+      "when": "grep -rn env.CACHE walks the src/ tree",
+      "then": "the search returns one file src/kv-facade.mjs and no other match",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tags": [
+    "blueprint:platform-cloudflare-kv"
+  ]
+}

package/rcf/user-stories/us-5101.json

@@ -0,0 +1,36 @@
+{
+  "createdAt": "2026-09-07T10:18:40.753Z",
+  "updatedAt": "2026-09-07T10:20:10.276Z",
+  "usId": "US-5101",
+  "prdId": "PRD-001",
+  "reqId": "REQ-051",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-1 typed put get delete round-trip against the KV driver realises the Workers KV binding shape",
+  "asA": "shelf consumer applying platform-cloudflare-kv v1.0.0",
+  "iWant": "typed put and get verbs that round-trip a value through the KV driver realising the Workers KV binding shape",
+  "soThat": "the applied project can persist a small piece of state and read it back deterministically, in the same shape the real Workers KV binding would present",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-5101-1",
+      "description": "facade.put(key, value) writes a value; facade.get(key) returns the same bytes; both operations emit their paired lifecycle events (kvWrite on put, kvHit on get). The round-trip works against the in-memory KV driver in the fixture (kv-driver.mjs) whose binding shape matches the real Workers KV binding contract per https://developers.cloudflare.com/kv/api/.",
+      "given": "the facade wired to the in-memory KV driver in the cf-platform fixture",
+      "when": "the facade-round-trip probe puts a fixture key/value and reads it back",
+      "then": "the read returns the same bytes; the event sink records one kvWrite and one kvHit; the probe report aggregates to pass",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-5101-2",
+      "description": "facade.delete(key) removes a value; a subsequent facade.get(key) returns null and emits kvMiss.",
+      "given": "a key previously put via the facade",
+      "when": "facade.delete(key) then facade.get(key)",
+      "then": "the delete emits kvWrite; the get returns null and emits kvMiss",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tags": [
+    "blueprint:platform-cloudflare-kv"
+  ]
+}

package/rcf/user-stories/us-5102.json

@@ -0,0 +1,27 @@
+{
+  "createdAt": "2026-09-07T10:18:40.958Z",
+  "updatedAt": "2026-09-07T10:20:10.276Z",
+  "usId": "US-5102",
+  "prdId": "PRD-001",
+  "reqId": "REQ-051",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-1 list with prefix returns every key under the prefix with metadata shape intact",
+  "asA": "shelf consumer applying platform-cloudflare-kv v1.0.0",
+  "iWant": "facade.list({prefix}) to return every key under a prefix with the metadata shape intact",
+  "soThat": "the applied project can enumerate feature flags, sessions, or any prefix-scoped collection through one seam",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-5102-1",
+      "description": "The list-with-prefix probe puts 10 keys under the prefix flags/ (each with a metadata blob) and calls facade.list({prefix: flags/}). The result returns all 10 keys, each entry carrying {name, metadata}, and every name preserves the domain-visible key (without the fixture keyPrefix if one was set).",
+      "given": "10 keys put under a shared prefix through the facade",
+      "when": "facade.list({prefix: flags/}) runs",
+      "then": "the result carries 10 entries with correct name and metadata fields; the aggregate probe verdict is pass",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tags": [
+    "blueprint:platform-cloudflare-kv"
+  ]
+}

package/rcf/user-stories/us-5201.json

@@ -0,0 +1,36 @@
+{
+  "createdAt": "2026-09-07T10:18:41.162Z",
+  "updatedAt": "2026-09-07T10:20:10.276Z",
+  "usId": "US-5201",
+  "prdId": "PRD-001",
+  "reqId": "REQ-052",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-1 cache-aside helper: hit-then-miss with a fake clock proves one origin call within TTL and a second past TTL",
+  "asA": "shelf consumer applying platform-cloudflare-kv v1.0.0",
+  "iWant": "the cache-aside helper to read from KV first and fall back to origin on miss, writing back with the elicited TTL",
+  "soThat": "the origin surface (a database, a downstream service) is spared one call per cached hit within TTL",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-5201-1",
+      "description": "On first call, cache-aside.getOr(key, originFn) finds nothing in the facade, invokes originFn once, writes back with the elicited TTL, and returns the fresh value with source origin. On second call within TTL, the read is served from the facade (source cache) and originFn is NOT invoked (the invocation counter stays at 1).",
+      "given": "a fresh key and an origin function that increments a counter each call",
+      "when": "getOr(key, originFn) runs twice within TTL",
+      "then": "the invocation counter reaches 1; both calls return the same value; the second read reports source cache",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-5201-2",
+      "description": "After the TTL elapses (in-memory driver clock advances past the expiration), cache-aside.getOr(key, originFn) finds nothing and invokes originFn a second time. The invocation counter reaches 2.",
+      "given": "a key past its TTL",
+      "when": "getOr(key, originFn) runs after clock advance past TTL",
+      "then": "the invocation counter reaches 2; the returned value comes from origin",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tags": [
+    "blueprint:platform-cloudflare-kv"
+  ]
+}

package/rcf/user-stories/us-5301.json

@@ -0,0 +1,27 @@
+{
+  "createdAt": "2026-09-07T10:18:41.367Z",
+  "updatedAt": "2026-09-07T10:20:10.276Z",
+  "usId": "US-5301",
+  "prdId": "PRD-001",
+  "reqId": "REQ-053",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-1 lifecycle events fire on facadeReady kvHit kvMiss kvWrite with metadata-only payload",
+  "asA": "shelf consumer applying platform-cloudflare-kv v1.0.0",
+  "iWant": "the facade to emit facadeReady kvHit kvMiss kvWrite events with metadata-only payload on the injected sink",
+  "soThat": "the applied logging companion can render KV activity without ever writing a body byte to the log stream",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-5301-1",
+      "description": "Each lifecycle event emitted by the facade carries EXACTLY the whitelist {event, key, size, ttl, timestamp}. No body value, no metadata blob, no additional field ever appears on the record the sink receives.",
+      "given": "the facade wired to a spy event sink, with a mix of put/get/delete/list operations",
+      "when": "the operations run",
+      "then": "the sink records each event with only the whitelist keys; any extra key trips the probe",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tags": [
+    "blueprint:platform-cloudflare-kv"
+  ]
+}

package/rcf/user-stories/us-5302.json

@@ -0,0 +1,27 @@
+{
+  "createdAt": "2026-09-07T10:18:41.585Z",
+  "updatedAt": "2026-09-07T10:20:10.276Z",
+  "usId": "US-5302",
+  "prdId": "PRD-001",
+  "reqId": "REQ-053",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-1 event secrecy: no body bytes no PII no user id beyond the key ever reach the event sink",
+  "asA": "shelf consumer applying platform-cloudflare-kv v1.0.0",
+  "iWant": "the event-secrecy probe to prove no body bytes or PII ever reach the event sink",
+  "soThat": "the operator can trust that a KV that holds a PII fixture (users/1234/profile with SSN) never leaks the body to the log stream even under a mutation-run",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-5302-1",
+      "description": "The event-secrecy probe puts, gets and deletes a PII fixture (key users/1234/profile, body {ssn: REDACTED-fixture}); every event record on the sink carries only the whitelist and no substring of the SSN, no substring of the user id beyond the key itself, and no substring of the body. A mutation-run turning on SIMULATE_PII_LEAK flips the probe to fail with the leaked field named.",
+      "given": "the facade wired to a spy sink with a PII fixture",
+      "when": "put/get/delete operations run on the PII key",
+      "then": "the recorded events contain only the whitelist; PII-substring scan returns zero hits; the mutation-run under SIMULATE_PII_LEAK trips the probe to fail",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tags": [
+    "blueprint:platform-cloudflare-kv"
+  ]
+}

package/rcf/user-stories/us-5401.json

@@ -0,0 +1,27 @@
+{
+  "createdAt": "2026-09-07T10:18:41.795Z",
+  "updatedAt": "2026-09-07T10:20:10.276Z",
+  "usId": "US-5401",
+  "prdId": "PRD-001",
+  "reqId": "REQ-054",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-1 real-account eventual-consistency smoke: write eventually appears on a global read within a bounded 60-second cap or records accountBoundSkipped in CI",
+  "asA": "shelf consumer applying platform-cloudflare-kv v1.0.0 in CI with real Cloudflare credentials",
+  "iWant": "the real-account eventual-consistency smoke to open the facade against a real KV namespace and observe the write eventually appearing on a global read",
+  "soThat": "the applied project has one probe that exercises the real vendor surface (not just the in-memory driver) and closes the mechanism-reach gap between fixture and production",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-5401-1",
+      "description": "When CI_HAS_CLOUDFLARE_ACCOUNT is set (with CF_ACCOUNT_ID, CF_KV_NAMESPACE_ID and CF_API_TOKEN), the real-account probe opens the facade against the real KV namespace via the Workers KV REST API, writes a fixture key, polls the same key with bounded 60-second cap, and asserts the value eventually returns. Without CI_HAS_CLOUDFLARE_ACCOUNT the probe records accountBoundSkipped true and the aggregate flips to pass per spec section 3.5. The probe cleans up its written key on exit.",
+      "given": "the real-account smoke shim with or without CI_HAS_CLOUDFLARE_ACCOUNT",
+      "when": "the shim runs",
+      "then": "with the env var: the write eventually returns within 60 seconds and the aggregate is pass; without: the aggregate is pass and the report records accountBoundSkipped true",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tags": [
+    "blueprint:platform-cloudflare-kv"
+  ]
+}

package/rcf/user-stories/us-6001.json

@@ -0,0 +1,27 @@
+{
+  "createdAt": "2026-09-07T12:28:01.537Z",
+  "updatedAt": "2026-09-07T12:28:01.537Z",
+  "asA": "shelf consumer applying the platform-cloudflare-cron-triggers v1.0.0 blueprint on a Workers project using the cf-platform fixture",
+  "iWant": "one scheduled() handler module (src/scheduled.mjs) that opens against the elicited cron triggers on process boot, wires the dispatcher and event sink, and emits a cronReady lifecycle event with a metadata-only payload",
+  "soThat": "boot ordering is observable, the scheduled seam is a single call site, and the applied project can compose its own bootstrapping around one predictable event",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-6001-1",
+      "description": "On process boot, the scheduled handler binds against the elicited cron triggers (the [triggers] crons block in wrangler.toml on the fixture), wires the dispatcher and the injected event sink, and emits a cronReady event on the sink with a payload of exactly {event, key, size, ttl, timestamp} where key is null, size is 0 and ttl is null. The scheduled handler does NOT dereference the KV binding (env.CACHE stays owned by the T-1 facade).",
+      "given": "a Node or Worker process with the scheduled handler module imported and its factory invoked with the elicited configuration",
+      "when": "the process boots and the scheduled handler ready() call resolves",
+      "then": "a cronReady event fires on the injected event sink with the metadata-only payload; the module does not dereference env.CACHE",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tags": [
+    "blueprint:platform-cloudflare-cron-triggers"
+  ],
+  "usId": "US-6001",
+  "prdId": "PRD-001",
+  "reqId": "REQ-060",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-2 scheduled() handler opens against the elicited cron triggers on boot and emits cronReady"
+}

package/rcf/user-stories/us-6002.json

@@ -0,0 +1,27 @@
+{
+  "createdAt": "2026-09-07T12:28:01.742Z",
+  "updatedAt": "2026-09-07T12:28:01.742Z",
+  "asA": "reviewer verifying the platform-cloudflare-cron-triggers v1.0.0 blueprint at mechanism reach",
+  "iWant": "the wrangler-test-scheduled probe to spawn wrangler dev --test-scheduled on the cf-platform fixture, drive its scheduled-fire route with a cron expression declared in wrangler.toml, assert a cronFired event fires on the sink and wrangler exits cleanly",
+  "soThat": "the shipped scheduled() handler is proven wired to the vendor's CLI seam, not only to an in-process spy",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-6002-1",
+      "description": "The wrangler-test-scheduled probe spawns wrangler dev --test-scheduled from the cf-platform fixture, waits bounded 30 seconds for the CLI to bind, drives its scheduled-fire route with an expression from wrangler.toml's [triggers] crons block, asserts a cronFired event fires on the injected sink with metadata {expression, scheduledTime, outcome, duration}, kills wrangler cleanly on exit, and returns aggregateVerdict: pass. On a shipped wrangler regression that prevents --test-scheduled from binding, the probe returns aggregateVerdict: warn with the observed CLI stderr quoted and the mechanism-reach gap noted, per section 3.1 pass-with-skip conventions.",
+      "given": "wrangler installed as a devDependency on the cf-platform fixture and the [triggers] crons block declared in wrangler.toml",
+      "when": "the probe runs from the fixture directory",
+      "then": "wrangler dev --test-scheduled binds, the scheduled-fire route drives a cronFired event and wrangler exits cleanly",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tags": [
+    "blueprint:platform-cloudflare-cron-triggers"
+  ],
+  "usId": "US-6002",
+  "prdId": "PRD-001",
+  "reqId": "REQ-060",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-2 wrangler dev --test-scheduled fires cronFired on the fixture handler"
+}

package/rcf/user-stories/us-6003.json

@@ -0,0 +1,27 @@
+{
+  "createdAt": "2026-09-07T12:28:01.964Z",
+  "updatedAt": "2026-09-07T12:28:01.964Z",
+  "asA": "operator validating platform-cloudflare-cron-triggers v1.0.0 against a real Cloudflare account",
+  "iWant": "the real-account-scheduled-smoke probe to schedule a per-minute cron on a real Worker, wait bounded 90 seconds and assert cronFired fires at least once",
+  "soThat": "the shipped scheduled() surface is proven against the vendor's global cron scheduler, not only against wrangler dev",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-6003-1",
+      "description": "The real-account-scheduled-smoke probe, when CI_HAS_CLOUDFLARE_ACCOUNT=true and the paired CF_ACCOUNT_ID / CF_WORKER_NAME / CF_API_TOKEN env vars are set, deploys a scheduled Worker with a per-minute cron expression (* * * * *), waits bounded 90 seconds (poll every 5s) for a cronFired event to appear on the Worker's log stream, and returns aggregateVerdict: pass. Without CI_HAS_CLOUDFLARE_ACCOUNT the probe records accountBoundSkipped: true and aggregates to pass per spec section 3.5.",
+      "given": "a real Cloudflare account with the paired env vars, or no such account and CI_HAS_CLOUDFLARE_ACCOUNT unset",
+      "when": "the probe runs",
+      "then": "with the account: cronFired appears within 90s and the probe passes. Without the account: the probe records accountBoundSkipped: true and exits 0.",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tags": [
+    "blueprint:platform-cloudflare-cron-triggers"
+  ],
+  "usId": "US-6003",
+  "prdId": "PRD-001",
+  "reqId": "REQ-060",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-2 real-account live-cron smoke fires cronFired at least once against a real Cloudflare Worker"
+}

package/rcf/user-stories/us-6101.json

@@ -0,0 +1,36 @@
+{
+  "createdAt": "2026-09-07T12:28:02.169Z",
+  "updatedAt": "2026-09-07T12:28:02.169Z",
+  "asA": "developer whose Worker needs to schedule two or more distinct workloads on distinct cron cadences",
+  "iWant": "one dispatcher module (src/dispatcher.mjs) that accepts an ordered map of cron expressions to handler functions and, on every scheduled invocation, routes to the matched handler with a bounded context",
+  "soThat": "one wrangler.toml [triggers] block with multiple cron expressions cleanly maps to distinct handler code paths without hand-rolled conditionals",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-6101-1",
+      "description": "createDispatcher({routes: [{expression, handler}, ...], eventSink}) returns a dispatch(event) function. Calling dispatch({cron: '* * * * *', scheduledTime}) invokes exactly the handler whose expression is '* * * * *' and passes {expression, scheduledTime, sink} to it; no other route's handler is called on that dispatch.",
+      "given": "a dispatcher wired with two routes and two spy handlers",
+      "when": "dispatch is called with a specific expression",
+      "then": "only the matched spy handler is invoked exactly once with the bounded context",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-6101-2",
+      "description": "Calling dispatch({cron: expressionNotInRoutes, scheduledTime}) does NOT invoke any handler, fires a cronUnmatched event on the sink with metadata {expression, scheduledTime, outcome: unmatched, duration: 0} and returns without side effect.",
+      "given": "a dispatcher wired with two routes and two spy handlers",
+      "when": "dispatch is called with an expression not in the routes",
+      "then": "no spy is called, a cronUnmatched event fires, and dispatch returns without side effect",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tags": [
+    "blueprint:platform-cloudflare-cron-triggers"
+  ],
+  "usId": "US-6101",
+  "prdId": "PRD-001",
+  "reqId": "REQ-061",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-2 dispatcher routes multiple cron expressions to distinct handlers by expression match"
+}