rcf-lite 0.23.0 → 0.24.0

package/rcf/user-stories/us-6201.json

@@ -0,0 +1,36 @@
+{
+  "createdAt": "2026-09-07T12:28:02.375Z",
+  "updatedAt": "2026-09-07T12:28:02.375Z",
+  "asA": "operator observing the timeliness of scheduled work on a Worker",
+  "iWant": "the dispatcher to classify every fire against an elicited skew window and record cronSkewed for late fires with the delta",
+  "soThat": "the applied logging companion surfaces cron drift as a first-class signal without every handler having to keep its own clock",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-6201-1",
+      "description": "With an elicited skew window of 30 seconds and a fake clock aligned to scheduledTime, dispatching a scheduled event fires cronFired with {expression, scheduledTime, outcome: onTime, duration: >=0} on the sink; no cronSkewed event fires for that dispatch.",
+      "given": "a dispatcher configured with skewToleranceMs=30000 and a fake clock aligned to scheduledTime",
+      "when": "an event is dispatched",
+      "then": "a cronFired event fires with outcome onTime and no cronSkewed fires",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-6201-2",
+      "description": "With an elicited skew window of 30 seconds and a fake clock advanced 60000ms past scheduledTime, dispatching a scheduled event fires cronSkewed with {expression, scheduledTime, outcome: skewed, duration: >=0, deltaMs: 60000} on the sink; the routed handler still runs.",
+      "given": "a dispatcher configured with skewToleranceMs=30000 and a fake clock advanced 60000ms past scheduledTime",
+      "when": "an event is dispatched",
+      "then": "a cronSkewed event fires with the observed delta and the handler still runs",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tags": [
+    "blueprint:platform-cloudflare-cron-triggers"
+  ],
+  "usId": "US-6201",
+  "prdId": "PRD-001",
+  "reqId": "REQ-062",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-2 skew tolerance: fires inside the elicited window are onTime; outside record cronSkewed with delta"
+}

package/rcf/user-stories/us-6301.json

@@ -0,0 +1,36 @@
+{
+  "createdAt": "2026-09-07T12:28:02.582Z",
+  "updatedAt": "2026-09-07T12:28:02.582Z",
+  "asA": "operator observing long-running scheduled work on a Worker",
+  "iWant": "the dispatcher to fire cronStalled at the moment a handler's observed duration crosses the elicited soft budget, without terminating the handler",
+  "soThat": "the applied logging companion surfaces stalled fires as a first-class signal, and the Worker's own CPU budget remains the vendor's concern",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-6301-1",
+      "description": "With softBudgetMs=100 and a spy handler that resolves after 250ms of fake-clock time, dispatching fires exactly one cronStalled event on the sink with {expression, scheduledTime, outcome: stalled, duration: >=100, softBudgetMs: 100} at the moment the observed duration crosses 100ms.",
+      "given": "a dispatcher configured with softBudgetMs=100 and a spy handler that resolves after 250ms fake-clock",
+      "when": "an event is dispatched",
+      "then": "a cronStalled event fires exactly once with the observed duration at or past the budget",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-6301-2",
+      "description": "With softBudgetMs=100 and a spy handler that resolves after 250ms of fake-clock time, the dispatcher does NOT terminate the handler on the soft-budget breach; the handler runs to completion, resolves, and a final cronFired event follows the cronStalled record with the total duration.",
+      "given": "a dispatcher configured with softBudgetMs=100 and a spy handler that resolves after 250ms fake-clock",
+      "when": "an event is dispatched",
+      "then": "the handler runs to completion and a cronFired follows the cronStalled record",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tags": [
+    "blueprint:platform-cloudflare-cron-triggers"
+  ],
+  "usId": "US-6301",
+  "prdId": "PRD-001",
+  "reqId": "REQ-063",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-2 soft budget: a handler running past the elicited budget logs cronStalled and continues"
+}

package/rcf/user-stories/us-6302.json

@@ -0,0 +1,27 @@
+{
+  "createdAt": "2026-09-07T12:28:02.788Z",
+  "updatedAt": "2026-09-07T12:28:02.788Z",
+  "asA": "security reviewer reading the applied logging companion's stream",
+  "iWant": "every cron lifecycle event record to carry only {event, expression, scheduledTime, outcome, duration} and optional numeric metadata fields; never a handler input, closure or PII substring",
+  "soThat": "the logging stream stays safe to ship to any downstream sink without a per-blueprint scrub pass",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-6302-1",
+      "description": "The event-secrecy probe drives the dispatcher with a spy handler that receives a PII fixture ({userId, ssn}) via a closure, and drives put/get/delete-style operations on a fixture key. The probe asserts (layer 1) every event record's keys are a subset of the allow-list {event, expression, scheduledTime, outcome, duration, softBudgetMs, deltaMs}; and (layer 2) the JSON serialisation of every record (excluding the expression field, which is a legitimate literal from wrangler.toml) contains no PII substring (userId numeric, ssn placeholder). SIMULATE_PII_LEAK=true injects a wrapper sink that forwards the closure onto the record; the probe surfaces the forbidden keys and the leaked substrings and returns aggregateVerdict: fail.",
+      "given": "the event-secrecy probe run under both modes",
+      "when": "the shipped code path runs without the switch; the mutation-path runs with SIMULATE_PII_LEAK=true",
+      "then": "shipped: aggregateVerdict pass with zero forbidden keys and zero PII hits. Switch on: aggregateVerdict fail with the leaked fields named.",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tags": [
+    "blueprint:platform-cloudflare-cron-triggers"
+  ],
+  "usId": "US-6302",
+  "prdId": "PRD-001",
+  "reqId": "REQ-063",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-2 event secrecy: every scheduled-side event record carries only metadata; no closure or PII"
+}

package/rcf/user-stories/us-7001.json

@@ -0,0 +1,27 @@
+{
+  "createdAt": "2026-09-07T14:11:53.037Z",
+  "updatedAt": "2026-09-07T14:13:26.508Z",
+  "usId": "US-7001",
+  "prdId": "PRD-001",
+  "reqId": "REQ-070",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-3 DO facade opens against env.CELL and env.HUB and emits namespaceReady",
+  "asA": "shelf consumer applying the platform-cloudflare-durable-objects v1.0.0 blueprint on a Workers project using the cf-platform fixture",
+  "iWant": "one DO facade module (src/do-facade.mjs) that opens against env.CELL and env.HUB on boot, wires the injected event sink and emits a namespaceReady lifecycle event with a metadata-only payload",
+  "soThat": "boot ordering is observable, the DO namespace seam is a single call site, and the applied project can compose its own bootstrapping around one predictable event",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-7001-1",
+      "description": "On process boot, createDoFacadeInProcess (the in-process seam over the shipped facade code path) wires the injected event sink and emits a namespaceReady event on the sink with a payload of exactly {event, key, size, ttl, timestamp} where key is null, size is 0 and ttl is null. facade.cell(name) and facade.hub(name) return the registered SingleCellObject and HubObject instances.",
+      "given": "a facade wired with in-process SingleCellObject and HubObject instances and a spy event sink",
+      "when": "the facade ready() call resolves",
+      "then": "a namespaceReady event fires exactly once on the sink with the metadata-only payload; the registered handles return the instances",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tags": [
+    "blueprint:platform-cloudflare-durable-objects"
+  ]
+}

package/rcf/user-stories/us-7002.json

@@ -0,0 +1,27 @@
+{
+  "createdAt": "2026-09-07T14:11:54.952Z",
+  "updatedAt": "2026-09-07T14:13:26.508Z",
+  "usId": "US-7002",
+  "prdId": "PRD-001",
+  "reqId": "REQ-070",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-3 real-account storage smoke records accountBoundSkipped without env var",
+  "asA": "operator validating platform-cloudflare-durable-objects v1.0.0 against a real Cloudflare account",
+  "iWant": "the real-account-storage-smoke probe to record accountBoundSkipped and aggregate to pass when CI_HAS_CLOUDFLARE_ACCOUNT is unset",
+  "soThat": "the shipped account-bound seam matches the Clerk pattern (skip-in-CI when no account, run when one is available) per spec section 3.5",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-7002-1",
+      "description": "The real-account-storage-smoke probe with CI_HAS_CLOUDFLARE_ACCOUNT unset returns a single result with anchorAcId AC-33112-1 and verdict pass; the report carries accountBoundSkipped=true and aggregates to pass; exit code 0. With CI_HAS_CLOUDFLARE_ACCOUNT=true but any of CF_ACCOUNT_ID, CF_DO_NAMESPACE_ID or CF_API_TOKEN missing, the probe returns fail naming the missing keys.",
+      "given": "the real-account-storage-smoke probe module",
+      "when": "run without CI_HAS_CLOUDFLARE_ACCOUNT, and then with the env var but no paired creds",
+      "then": "the first run reports accountBoundSkipped and passes; the second reports the missing keys and fails",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tags": [
+    "blueprint:platform-cloudflare-durable-objects"
+  ]
+}

package/rcf/user-stories/us-7101.json

@@ -0,0 +1,27 @@
+{
+  "createdAt": "2026-09-07T14:11:53.254Z",
+  "updatedAt": "2026-09-07T14:13:26.508Z",
+  "usId": "US-7101",
+  "prdId": "PRD-001",
+  "reqId": "REQ-071",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-3 single-cell concurrent increments serialise per instance and return witness of prior write",
+  "asA": "developer whose Worker needs an authoritative counter, session store or lock behind a swappable boundary",
+  "iWant": "one SingleCellObject instance to observe concurrent increments in per-instance FIFO order and return the sum plus a written witness",
+  "soThat": "two concurrent callers cannot silently overwrite each other and a domain assertion can prove the write happened before the read",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-7101-1",
+      "description": "Two concurrent increment(1) invocations against a SingleCellObject with counter 0 resolve to counters [1, 2] and witnesses [0, 1] in FIFO order; a subsequent read() returns counter 2.",
+      "given": "a SingleCellObject at counter 0",
+      "when": "two concurrent increment(1) calls fire and read() follows",
+      "then": "counters are [1,2], witnesses are [0,1], read returns 2",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tags": [
+    "blueprint:platform-cloudflare-durable-objects"
+  ]
+}

package/rcf/user-stories/us-7201.json

@@ -0,0 +1,27 @@
+{
+  "createdAt": "2026-09-07T14:11:53.463Z",
+  "updatedAt": "2026-09-07T14:13:26.508Z",
+  "usId": "US-7201",
+  "prdId": "PRD-001",
+  "reqId": "REQ-072",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-3 storage round-trip covers put/get/delete/list on both SQL and KV backends",
+  "asA": "developer configuring the storage backend on a new SingleCellObject",
+  "iWant": "the shipped storage driver factory to round-trip put/get/delete/list on both SQL and KV backends",
+  "soThat": "the applied project can elicit the backend at apply time and the shipped code path exercises both branches without code changes",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-7201-1",
+      "description": "createInMemoryDoStorage({backend: \"sql\"}) and createInMemoryDoStorage({backend: \"kv\"}) both round-trip put(\"k\",\"v\")->get(\"k\"), delete(\"k\") followed by get returning undefined, and list({prefix:\"p/\"}) returning a Map keyed by the prefix. driver.backend reports the chosen backend on each factory.",
+      "given": "two storage drivers, one on each backend",
+      "when": "put/get/delete/list operations are driven on each driver in turn",
+      "then": "both round-trip identically and driver.backend reports the elicited answer",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tags": [
+    "blueprint:platform-cloudflare-durable-objects"
+  ]
+}

package/rcf/user-stories/us-7301.json

@@ -0,0 +1,27 @@
+{
+  "createdAt": "2026-09-07T14:11:53.683Z",
+  "updatedAt": "2026-09-07T14:13:26.508Z",
+  "usId": "US-7301",
+  "prdId": "PRD-001",
+  "reqId": "REQ-073",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-3 alarm fires exactly once and doAlarmFired records objectName and scheduledTime",
+  "asA": "developer whose SingleCellObject schedules future work via storage.setAlarm",
+  "iWant": "the alarm() handler to fire exactly once per scheduled time and doAlarmFired to carry objectName and scheduledTime",
+  "soThat": "the applied project can observe alarm delivery through the metadata-only sink and trust the once-per-schedule contract",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-7301-1",
+      "description": "A SingleCellObject with setAlarm(100) fires alarm() once. The handler drains the persisted alarm (storage.getAlarm returns null after) and emits doAlarmFired with objectName and scheduledTime. A second alarm() call on the drained storage records scheduledTime null (no re-fire for the same schedule).",
+      "given": "a SingleCellObject with setAlarm(100)",
+      "when": "alarm() is driven once and then again after the fire",
+      "then": "the first fire emits doAlarmFired with the scheduledTime; the second fire records scheduledTime null; storage.getAlarm returns null after the first fire",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tags": [
+    "blueprint:platform-cloudflare-durable-objects"
+  ]
+}

package/rcf/user-stories/us-7401.json

@@ -0,0 +1,27 @@
+{
+  "createdAt": "2026-09-07T14:11:53.895Z",
+  "updatedAt": "2026-09-07T14:13:26.508Z",
+  "usId": "US-7401",
+  "prdId": "PRD-001",
+  "reqId": "REQ-074",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-3 hub broadcast fans out a payload from A to all connected clients within the elicited window",
+  "asA": "developer coordinating multiplayer websocket clients through one authoritative hub",
+  "iWant": "the HubObject to fan out a broadcast payload from one connected client to all connected clients within the elicited window",
+  "soThat": "the shipped hub shape delivers the coordinated-multiplayer contract without a hand-rolled broadcast layer",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-7401-1",
+      "description": "A HubObject with two accepted fake websockets A and B, when driven with webSocketMessage(A, JSON.stringify({type:\"broadcast\", payload:\"ping\"})), delivers a JSON message to both A and B whose type is \"broadcast\" and payload is \"ping\" within 500ms elapsed on the fixture clock. The persisted lastBroadcast key in storage carries the serialised outbound payload.",
+      "given": "a HubObject with two accepted fake websockets",
+      "when": "a broadcast message is sent from A",
+      "then": "both A and B receive the broadcast within 500ms; storage.get(\"lastBroadcast\") returns the serialised payload",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tags": [
+    "blueprint:platform-cloudflare-durable-objects"
+  ]
+}

package/rcf/user-stories/us-7402.json

@@ -0,0 +1,27 @@
+{
+  "createdAt": "2026-09-07T14:11:54.109Z",
+  "updatedAt": "2026-09-07T14:13:26.508Z",
+  "usId": "US-7402",
+  "prdId": "PRD-001",
+  "reqId": "REQ-074",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-3 hibernate-and-wake round-trip preserves storage and doWakeUp fires exactly once",
+  "asA": "developer whose HubObject hibernates when idle and wakes on the next message",
+  "iWant": "the wake handler to run from cold and read the same lastBroadcast key from storage the pre-hibernate state persisted",
+  "soThat": "a re-emerging client can catch up on the missed broadcast without a full re-sync",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-7402-1",
+      "description": "A HubObject that has processed a broadcast, hibernated (doHibernate emitted), and then woken (doWakeUp emitted once) resolves wake() with lastBroadcast equal to the serialised outbound payload. A second wake() resolves with alreadyAwake=true and the same lastBroadcast; no second doWakeUp fires.",
+      "given": "a HubObject with a persisted lastBroadcast that has hibernated",
+      "when": "wake() is called once, then again",
+      "then": "the first wake emits doWakeUp once and returns lastBroadcast; the second wake reports alreadyAwake without a second event",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tags": [
+    "blueprint:platform-cloudflare-durable-objects"
+  ]
+}

package/rcf/user-stories/us-7501.json

@@ -0,0 +1,27 @@
+{
+  "createdAt": "2026-09-07T14:11:54.320Z",
+  "updatedAt": "2026-09-07T14:13:26.508Z",
+  "usId": "US-7501",
+  "prdId": "PRD-001",
+  "reqId": "REQ-075",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-3 lifecycle events on the shipped path carry only allowed metadata keys",
+  "asA": "reviewer verifying the platform-cloudflare-durable-objects v1.0.0 blueprint at mechanism reach",
+  "iWant": "every lifecycle event emitted on the shipped code path to carry only the allowed metadata keys and never a forbidden key",
+  "soThat": "a logging companion can render the sink directly without a per-blueprint scrub pass",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-7501-1",
+      "description": "The event-secrecy result on the websocket-hub-broadcast probe scans every record emitted through the facade and both DO classes on the shipped path and asserts every top-level key is drawn from {event, key, size, ttl, timestamp, objectName, scheduledTime}. Under SIMULATE_PII_LEAK=true a wrapped sink forwards a synthetic body-bearing record; the probe surfaces the forbidden keys (body, ssn, userId) and returns fail on the AC-33106-1 result.",
+      "given": "a driven facade + single-cell + hub with an accumulating spy sink, and the SIMULATE_PII_LEAK switch",
+      "when": "the event-secrecy AC-33106-1 result runs on the shipped path and the simulate path",
+      "then": "the shipped path returns pass with zero forbidden keys; the simulate path surfaces the injected fields and returns fail",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tags": [
+    "blueprint:platform-cloudflare-durable-objects"
+  ]
+}

package/rcf/user-stories/us-7601.json

@@ -0,0 +1,27 @@
+{
+  "createdAt": "2026-09-07T14:11:54.530Z",
+  "updatedAt": "2026-09-07T14:13:26.508Z",
+  "usId": "US-7601",
+  "prdId": "PRD-001",
+  "reqId": "REQ-076",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-3 sole-reader-scan probe surfaces every non-facade module that dereferences env.CELL or env.HUB",
+  "asA": "reviewer enforcing the sole-reader guarantee on env.CELL and env.HUB",
+  "iWant": "the sole-reader-scan probe to walk every .mjs/.js/.ts file under the fixture applied source root and assert only src/do-facade.mjs dereferences env.CELL or env.HUB in live source",
+  "soThat": "a legacy call site or an accidental new one surfaces at self-review, not at runtime",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-7601-1",
+      "description": "The sole-reader-scan probe reads every .mjs/.js/.ts file under packages/rcf-lite/test/fixtures/cf-platform/src, strips block and line comments, matches literal env.CELL and env.HUB and reports every non-facade file with a live match as a leak. The clean-fixture scan surfaces zero leaks. Under SIMULATE_NON_FACADE_IMPORT=true a scratch leaker at $TMPDIR/t3-sole-reader-scratch is included in the scan; the scan surfaces the leak and returns fail.",
+      "given": "the cf-platform fixture applied source root, and optionally the SIMULATE_NON_FACADE_IMPORT switch",
+      "when": "the sole-reader-scan probe runs",
+      "then": "clean scan returns pass with zero leaks; simulate scan surfaces the injected leaker and returns fail",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tags": [
+    "blueprint:platform-cloudflare-durable-objects"
+  ]
+}

package/rcf/user-stories/us-7701.json

@@ -0,0 +1,27 @@
+{
+  "createdAt": "2026-09-07T14:11:54.740Z",
+  "updatedAt": "2026-09-07T14:13:26.508Z",
+  "usId": "US-7701",
+  "prdId": "PRD-001",
+  "reqId": "REQ-077",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-3 wrangler.toml commits stable DO class names on both binding blocks and a migrations tag records the mint classes",
+  "asA": "operator applying platform-cloudflare-durable-objects on a fresh Workers project",
+  "iWant": "the generated wrangler.toml to carry [[durable_objects.bindings]] blocks and a paired [[migrations]] block with a stable tag",
+  "soThat": "a future rename lands as a wrangler migration rather than a silent rewire and the DO class identity survives the mint",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-7701-1",
+      "description": "The fixture wrangler.toml carries at least two [[durable_objects.bindings]] blocks (one binding named CELL with class_name SingleCellObject; one binding named HUB with class_name HubObject) and at least one [[migrations]] block with tag \"v1\" and new_classes = [\"SingleCellObject\", \"HubObject\"]. The anatomy assertion greps the toml for each literal string and the migrations pair.",
+      "given": "the cf-platform fixture wrangler.toml",
+      "when": "the anatomy assertion greps for the four literal strings and the migrations pair",
+      "then": "every string is present and the migrations tag \"v1\" carries the two class names",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tags": [
+    "blueprint:platform-cloudflare-durable-objects"
+  ]
+}

package/rcf/user-stories/us-8001.json

@@ -0,0 +1,24 @@
+{
+  "createdAt": "2026-09-07T16:49:29.505Z",
+  "updatedAt": "2026-09-07T16:51:26.217Z",
+  "usId": "US-8001",
+  "prdId": "PRD-001",
+  "reqId": "REQ-080",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-4 JWT validator: fixture-signed JWT validates and principal reduces onto request.auth",
+  "asA": "shelf consumer applying the edge-cloudflare-access v1.0.0 blueprint on a Workers project using the cf-edge fixture",
+  "iWant": "the Cf-Access-Jwt-Assertion header validated against the Access JWKS on every request, the principal reduced into request.auth as {email, sub, groups} and the downstream handler observes 200 with the reduced principal fields",
+  "soThat": "the Worker only ever sees authenticated principals and downstream code reads a single stable seam for identity",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-8001-1",
+      "description": "The JWT validator reads Cf-Access-Jwt-Assertion, verifies against the fixture JWKS (RS256, kid rotation supported by cache), reduces the principal into request.auth as {email, sub, groups} and the downstream handler receives a 200 with the reduced principal fields exposed on request.auth.",
+      "given": "a Worker fetch handler wired with the createAccessValidator middleware and a fixture-signed JWT presented in the Cf-Access-Jwt-Assertion header",
+      "when": "the request dispatches through the validator",
+      "then": "the validator resolves, attaches {email, sub, groups} onto request.auth and delegates to the handler which returns 200 with request.auth reflected on the response body",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ]
+}

package/rcf/user-stories/us-8002.json

@@ -0,0 +1,24 @@
+{
+  "createdAt": "2026-09-07T16:49:29.726Z",
+  "updatedAt": "2026-09-07T16:51:26.402Z",
+  "usId": "US-8002",
+  "prdId": "PRD-001",
+  "reqId": "REQ-080",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-4 JWT validator: missing, expired or mis-signed JWT rejects 401 with metadata-only audit event",
+  "asA": "shelf consumer applying the edge-cloudflare-access v1.0.0 blueprint on a Workers project using the cf-edge fixture",
+  "iWant": "requests carrying a missing, expired or mis-signed JWT to reject with 401 and emit exactly one metadata-only audit event on the shipped audit sink",
+  "soThat": "unauthenticated traffic cannot reach the downstream handler and every reject is observable without leaking the token value or headers",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-8002-1",
+      "description": "The three reject subcases (missing header, expired exp, mis-signed) each return HTTP 401 and emit exactly one audit event whose keys are drawn from {email, outcome, timestamp, path} with no token substring, no header names beyond path, and no additional keys.",
+      "given": "a Worker fetch handler wired with the createAccessValidator middleware and one of the three reject subcases",
+      "when": "the request dispatches through the validator",
+      "then": "the validator resolves 401, emits one audit event with outcome in {missing, expired, invalid} and the record body carries only the four allowed keys",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ]
+}

package/rcf/user-stories/us-8003.json

@@ -0,0 +1,24 @@
+{
+  "createdAt": "2026-09-07T16:49:29.941Z",
+  "updatedAt": "2026-09-07T16:51:26.586Z",
+  "usId": "US-8003",
+  "prdId": "PRD-001",
+  "reqId": "REQ-080",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-4 JWT validator is the sole reader of the Cf-Access-Jwt-Assertion header in the applied source tree",
+  "asA": "shelf consumer applying the edge-cloudflare-access v1.0.0 blueprint on a Workers project using the cf-edge fixture",
+  "iWant": "only src/jwt-validator.mjs to dereference the Cf-Access-Jwt-Assertion header string in the applied source tree",
+  "soThat": "the validator is the single seam and a stray header read in the applied code is a defect the AST scan catches",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-8003-1",
+      "description": "The sole-reader scan walks the fixture applied source root (src/**/*.mjs), strips comments and string literals, and finds exactly one live source occurrence of the header string Cf-Access-Jwt-Assertion, in src/jwt-validator.mjs. Any other occurrence in a shipped module fails the probe.",
+      "given": "the cf-edge fixture applied source tree",
+      "when": "the sole-reader-scan probe walks src/**/*.mjs",
+      "then": "the only live-source hit for Cf-Access-Jwt-Assertion is in src/jwt-validator.mjs; SIMULATE_NON_VALIDATOR_HEADER=true injects a second hit and the probe fails",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ]
+}

package/rcf/user-stories/us-8101.json

@@ -0,0 +1,24 @@
+{
+  "createdAt": "2026-09-07T16:49:30.157Z",
+  "updatedAt": "2026-09-07T16:51:52.835Z",
+  "usId": "US-8101",
+  "prdId": "PRD-001",
+  "reqId": "REQ-081",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-4 Access application declared with elicited hostname or self-hosted-app id and elicited policy shape",
+  "asA": "operator applying the edge-cloudflare-access v1.0.0 blueprint",
+  "iWant": "the blueprint to elicit either an Access application hostname or a self-hosted-app id, plus a policy shape from the enum",
+  "soThat": "the apply record captures the exact Access application declaration the operator will issue in the Zero Trust dashboard or over the API",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-8101-1",
+      "description": "blueprint.json elicits access-application-host (kind string) or access-selfhosted-app-id (kind string, one of the two required at apply), plus access-policy-shape (kind enum, options email-domain, service-token-only, service-token-plus-email-domain, group-membership; recommended default email-domain). Applying the blueprint records the elicited values on rcf/blueprints/edge-cloudflare-access.applied.json.",
+      "given": "the blueprint.json elicits block",
+      "when": "the apply verb runs against a fixture project",
+      "then": "rcf/blueprints/edge-cloudflare-access.applied.json carries appliedCapabilities=[zeroTrustGate] and elicited values for access-application-host or access-selfhosted-app-id plus access-policy-shape",
+      "testable": true,
+      "scope": "library"
+    }
+  ]
+}

package/rcf/user-stories/us-8201.json

@@ -0,0 +1,24 @@
+{
+  "createdAt": "2026-09-07T16:49:30.372Z",
+  "updatedAt": "2026-09-07T16:51:53.022Z",
+  "usId": "US-8201",
+  "prdId": "PRD-001",
+  "reqId": "REQ-082",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-4 operator issues a Zero Trust policy via the guide's dashboard walk-through or the alternative API path",
+  "asA": "operator applying the edge-cloudflare-access v1.0.0 blueprint",
+  "iWant": "the guide to walk me through issuing the Zero Trust policy on the Cloudflare dashboard AND to document the alternative API path",
+  "soThat": "the policy issuance flow is unambiguous whether I use the dashboard or the API",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-8201-1",
+      "description": "The shipped guide/edge-cloudflare-access.md carries a section Zero Trust dashboard walk-through with numbered steps naming each screen; and a section API alternative with a curl example against https://api.cloudflare.com/client/v4/accounts/{account_id}/access/apps/{app_id}/policies; the vendor URL https://developers.cloudflare.com/cloudflare-one/policies/access/ is cited from ADR-3501 and the guide.",
+      "given": "the shipped guide file",
+      "when": "the anatomy test greps for the two section headings, the curl example and the vendor URL",
+      "then": "each string matches at least once in the file",
+      "testable": true,
+      "scope": "library"
+    }
+  ]
+}

package/rcf/user-stories/us-8301.json

@@ -0,0 +1,24 @@
+{
+  "createdAt": "2026-09-07T16:49:30.586Z",
+  "updatedAt": "2026-09-07T16:51:27.145Z",
+  "usId": "US-8301",
+  "prdId": "PRD-001",
+  "reqId": "REQ-083",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-4 audit event carries only email, outcome, timestamp and path; no token value or headers on any code path",
+  "asA": "shelf consumer applying the edge-cloudflare-access v1.0.0 blueprint on a Workers project using the cf-edge fixture",
+  "iWant": "the audit sink to receive only metadata-only records for every validate-pass and validate-reject",
+  "soThat": "the audit trail is observable without leaking the JWT, its signature bytes or any request header value",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-8301-1",
+      "description": "After 5 validate-pass and 5 validate-reject requests the audit sink holds 10 records each carrying exactly {email, outcome, timestamp, path}; the serialised JSON of every record contains no substring of the JWT (header, payload or signature), no Authorization value and no header names beyond path.",
+      "given": "the shipped createAccessValidator wired with a spy audit sink and 10 requests (5 pass, 5 reject)",
+      "when": "the requests dispatch through the validator",
+      "then": "10 sink records, each with allowed keys only, none containing forbidden substrings",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ]
+}

package/rcf/user-stories/us-8401.json

@@ -0,0 +1,24 @@
+{
+  "createdAt": "2026-09-07T16:49:30.802Z",
+  "updatedAt": "2026-09-07T16:51:27.332Z",
+  "usId": "US-8401",
+  "prdId": "PRD-001",
+  "reqId": "REQ-084",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-4 break-glass posture: an elicited bypass-service-auth token pair signs CI automation requests through the validator",
+  "asA": "operator running CI-signed automation against an Access-gated Worker",
+  "iWant": "an elicited bypass-service-auth token pair that the validator recognises and passes through as an authenticated principal",
+  "soThat": "CI can hit the gated Worker without a browser flow while every bypass leaves a distinct audit trace",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-8401-1",
+      "description": "When the request presents the elicited service-auth id and secret (as CF-Access-Client-Id and CF-Access-Client-Secret headers), the validator observes the pair, records outcome=bypass in the audit event with the same metadata-only shape, and delegates to the handler as authenticated with request.auth.email='service:'+id. Break-glass is disabled unless the elicited pair is applied.",
+      "given": "the createAccessValidator wired with an elicited bypass-service-auth pair and a request presenting the paired headers",
+      "when": "the request dispatches through the validator",
+      "then": "the handler receives request.auth with the service principal and the audit sink records outcome=bypass, with allowed keys only",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ]
+}

package/rcf/user-stories/us-8501.json

@@ -0,0 +1,24 @@
+{
+  "createdAt": "2026-09-07T16:49:31.016Z",
+  "updatedAt": "2026-09-07T16:51:27.519Z",
+  "usId": "US-8501",
+  "prdId": "PRD-001",
+  "reqId": "REQ-085",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-4 admin-console composition: the sign-in surface swaps to Access-gated when zeroTrustGate applied and falls back to security-auth-* otherwise",
+  "asA": "shelf consumer applying both edge-cloudflare-access and application-admin-console v1.1.0",
+  "iWant": "the admin-console sign-in surface to flip to Access-gated when zeroTrustGate is applied, and to fall back to the local security-auth-* surface otherwise",
+  "soThat": "the composition is deterministic and no local login form leaks into an Access-gated deployment",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-8501-1",
+      "description": "Two applied combinations are exercised on the extended admin-console fixture: with ?caps=principalDirectory,roleModel,auditLog,zeroTrustGate the sign-in surface renders [data-surface=access-gated] and no [data-surface=local-login] is present; with ?caps=principalDirectory,roleModel,auditLog the sign-in surface renders [data-surface=local-login] and no [data-surface=access-gated] is present. Both combinations exercise the shipped pack check AC-21815-1.",
+      "given": "the admin-console pack fixture with the two caps combinations",
+      "when": "the pack runs against each combination",
+      "then": "AC-21815-1 fires on the gated combination and passes; the existing v1.0.0 surface renders on the non-gated combination and its own check passes",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ]
+}

package/rcf/user-stories/us-8502.json

@@ -0,0 +1,24 @@
+{
+  "createdAt": "2026-09-07T16:49:31.234Z",
+  "updatedAt": "2026-09-07T16:51:27.703Z",
+  "usId": "US-8502",
+  "prdId": "PRD-001",
+  "reqId": "REQ-085",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-4 real-account gated URL: a request against a scheduled Access-configured hostname lands the Access UI",
+  "asA": "HQ operator running the real-account gated-URL smoke against a scheduled Access-configured hostname",
+  "iWant": "the probe to fire against the hostname when the env vars are present and record accountBoundSkipped when not",
+  "soThat": "the mechanism-reach claim is proven on a real Cloudflare Access instance without ever failing the shelf gate on the absence of an account",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-8502-1",
+      "description": "With CI_HAS_CLOUDFLARE_ACCOUNT=true and CF_ACCESS_HOST=<hostname>, a plain fetch against https://<hostname>/ follows the redirect chain and terminates at an https://<team>.cloudflareaccess.com/ URL (the Access UI). Without either env var the probe records accountBoundSkipped=true and aggregateVerdict=pass per spec section 3.5.",
+      "given": "the run-real-account-gated-url.mjs probe shim and the two env vars",
+      "when": "the probe runs",
+      "then": "in the CI-with-account path the redirect chain reports cloudflareaccess.com as terminal; in the without-env path accountBoundSkipped is true",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ]
+}