rcf-lite 0.23.0 → 0.24.0

package/blueprints/edge-cloudflare-access/contributions/probes/audit-event-secrecy.mjs

@@ -0,0 +1,70 @@
+// Probe: audit event secrecy - 10 records after 5 pass + 5 reject, no forbidden substrings.
+// anchorAcId: AC-34106-1. accountBound: false.
+
+export const anchorAcId = 'AC-34106-1';
+export const accountBound = false;
+
+export default async function runProbe() {
+  const { bootFixtureJwks, loadValidator, fixtureEnv, FIXTURE_AUDIENCE, FIXTURE_ISSUER } = await import('./probe-utils.mjs');
+
+  const boot = await bootFixtureJwks();
+  const createAccessValidator = await loadValidator();
+
+  const sink = [];
+  const validator = createAccessValidator({ env: fixtureEnv(boot.jwksUrl), eventSink: (r) => sink.push(r) });
+
+  const tokens = [];
+  // 5 pass runs
+  for (let i = 0; i < 5; i++) {
+    const jwt = boot.signerMod.fixtureAccessJwt({
+      key: boot.key,
+      profile: { issuer: FIXTURE_ISSUER, audience: FIXTURE_AUDIENCE },
+      principal: { email: `user${i}@example.com`, sub: `user:u${i}`, groups: ['members'] },
+      ttlSec: 60,
+    });
+    tokens.push(jwt);
+    const req = new Request(`https://cf-edge.fixture/pass/${i}`, { headers: { 'Cf-Access-Jwt-Assertion': jwt } });
+    await validator.middleware(req);
+  }
+  // 5 reject runs (missing header)
+  for (let i = 0; i < 5; i++) {
+    const req = new Request(`https://cf-edge.fixture/reject/${i}`);
+    await validator.middleware(req);
+  }
+
+  const results = [];
+  const allowed = ['email', 'outcome', 'path', 'timestamp'];
+  const shapeOk = sink.length === 10 && sink.every((r) => Object.keys(r).sort().join(',') === allowed.join(','));
+  results.push({
+    anchorAcId: 'AC-34106-1',
+    verdict: shapeOk ? 'pass' : 'fail',
+    detail: shapeOk
+      ? `10 audit records, allowed keys only (${allowed.join(',')})`
+      : `unexpected sink shape; count=${sink.length} sample=${JSON.stringify(sink[0] ?? null)}`,
+  });
+
+  // No forbidden substrings across the serialised sink.
+  const serialised = JSON.stringify(sink);
+  const forbidden = [];
+  for (const jwt of tokens) {
+    const parts = jwt.split('.');
+    // Include full JWT, header segment, payload segment and signature segment individually.
+    for (const seg of [jwt, parts[0], parts[1], parts[2]]) {
+      if (seg && serialised.includes(seg)) forbidden.push(`token-segment len=${seg.length}`);
+    }
+  }
+  for (const header of ['Cf-Access-Jwt-Assertion', 'Authorization', 'CF-Access-Client-Id', 'CF-Access-Client-Secret']) {
+    if (serialised.includes(header)) forbidden.push(`header-name ${header}`);
+  }
+  const secrecyOk = forbidden.length === 0;
+  results.push({
+    anchorAcId: 'AC-34106-1',
+    verdict: secrecyOk ? 'pass' : 'fail',
+    detail: secrecyOk
+      ? `no forbidden substrings in the serialised sink; ran 5 pass + 5 reject; sink JSON bytes=${serialised.length}`
+      : `forbidden substrings found: ${JSON.stringify(forbidden)}`,
+  });
+
+  await boot.stop();
+  return { results };
+}

package/blueprints/edge-cloudflare-access/contributions/probes/jwt-validator-fixture.mjs

@@ -0,0 +1,63 @@
+// Probe: JWT validator - fixture-signed JWT validates and principal reduces onto request.auth.
+// anchorAcId: AC-34101-1. accountBound: false.
+
+export const anchorAcId = 'AC-34101-1';
+export const accountBound = false;
+
+export default async function runProbe() {
+  const { bootFixtureJwks, loadValidator, fixtureEnv, FIXTURE_AUDIENCE, FIXTURE_ISSUER } = await import('./probe-utils.mjs');
+
+  const boot = await bootFixtureJwks();
+  const createAccessValidator = await loadValidator();
+
+  const sink = [];
+  const validator = createAccessValidator({ env: fixtureEnv(boot.jwksUrl), eventSink: (r) => sink.push(r) });
+
+  const jwt = boot.signerMod.fixtureAccessJwt({
+    key: boot.key,
+    profile: { issuer: FIXTURE_ISSUER, audience: FIXTURE_AUDIENCE },
+    principal: { email: 'ada@example.com', sub: 'user:ada', groups: ['admins', 'shipping'] },
+    ttlSec: 60,
+  });
+
+  const req = new Request('https://cf-edge.fixture/protected', {
+    headers: { 'Cf-Access-Jwt-Assertion': jwt },
+  });
+  const outcome = await validator.middleware(req);
+  const results = [];
+
+  const principal = outcome.outcome?.principal;
+  const okShape =
+    outcome.rejected === false &&
+    principal &&
+    principal.email === 'ada@example.com' &&
+    principal.sub === 'user:ada' &&
+    Array.isArray(principal.groups) &&
+    principal.groups.length === 2 &&
+    req.auth &&
+    req.auth.email === 'ada@example.com';
+
+  results.push({
+    anchorAcId: 'AC-34101-1',
+    verdict: okShape ? 'pass' : 'fail',
+    detail: okShape
+      ? `validator resolved; principal reduces to {email:${principal.email}, sub:${principal.sub}, groups:${JSON.stringify(principal.groups)}}; request.auth attached; audit outcome=validated`
+      : `validator did not resolve as expected; outcome=${JSON.stringify(outcome)} request.auth=${JSON.stringify(req.auth ?? null)}`,
+  });
+
+  // Audit sink should hold one record, allowed keys only, outcome=validated.
+  const record = sink[sink.length - 1];
+  const allowed = new Set(['email', 'outcome', 'timestamp', 'path']);
+  const extraKeys = record ? Object.keys(record).filter((k) => !allowed.has(k)) : ['(no record)'];
+  const auditOk = sink.length === 1 && record && record.outcome === 'validated' && record.email === 'ada@example.com' && record.path === '/protected' && extraKeys.length === 0;
+  results.push({
+    anchorAcId: 'AC-34101-1',
+    verdict: auditOk ? 'pass' : 'fail',
+    detail: auditOk
+      ? `one audit record with allowed keys only; outcome=validated email=${record.email} path=${record.path}`
+      : `unexpected audit shape; count=${sink.length} record=${JSON.stringify(record ?? null)} extraKeys=${JSON.stringify(extraKeys)}`,
+  });
+
+  await boot.stop();
+  return { results };
+}

package/blueprints/edge-cloudflare-access/contributions/probes/jwt-validator-reject.mjs

@@ -0,0 +1,95 @@
+// Probe: JWT validator reject cases - missing, expired, mis-signed each return 401 with metadata-only audit event.
+// anchorAcId: AC-34102-1. accountBound: false.
+
+export const anchorAcId = 'AC-34102-1';
+export const accountBound = false;
+
+export default async function runProbe() {
+  const { bootFixtureJwks, loadValidator, fixtureEnv, FIXTURE_AUDIENCE, FIXTURE_ISSUER } = await import('./probe-utils.mjs');
+
+  const boot = await bootFixtureJwks();
+  const createAccessValidator = await loadValidator();
+
+  const results = [];
+  const subcases = [];
+
+  // 1. Missing header
+  {
+    const sink = [];
+    const validator = createAccessValidator({ env: fixtureEnv(boot.jwksUrl), eventSink: (r) => sink.push(r) });
+    const req = new Request('https://cf-edge.fixture/protected');
+    const outcome = await validator.middleware(req);
+    subcases.push({
+      name: 'missing',
+      rejected: outcome.rejected,
+      status: outcome.response?.status,
+      auditCount: sink.length,
+      auditOutcome: sink[0]?.outcome,
+      auditKeys: sink[0] ? Object.keys(sink[0]).sort() : null,
+    });
+  }
+
+  // 2. Expired (SIMULATE_EXPIRED_JWT flag forces the code path)
+  {
+    const sink = [];
+    const validator = createAccessValidator({ env: fixtureEnv(boot.jwksUrl), eventSink: (r) => sink.push(r) });
+    const jwt = boot.signerMod.fixtureAccessJwt({
+      key: boot.key,
+      profile: { issuer: FIXTURE_ISSUER, audience: FIXTURE_AUDIENCE },
+      principal: { email: 'grace@example.com', sub: 'user:grace' },
+      ttlSec: 60,
+    });
+    const req = new Request('https://cf-edge.fixture/protected', { headers: { 'Cf-Access-Jwt-Assertion': jwt } });
+    const outcome = await validator.middleware(req, { SIMULATE_EXPIRED_JWT: true });
+    subcases.push({
+      name: 'expired',
+      rejected: outcome.rejected,
+      status: outcome.response?.status,
+      auditCount: sink.length,
+      auditOutcome: sink[0]?.outcome,
+      auditKeys: sink[0] ? Object.keys(sink[0]).sort() : null,
+    });
+  }
+
+  // 3. Mis-signed: sign with a DIFFERENT key, JWKS only carries the fixture key.
+  {
+    const sink = [];
+    const validator = createAccessValidator({ env: fixtureEnv(boot.jwksUrl), eventSink: (r) => sink.push(r) });
+    const wrongKey = boot.signerMod.createFixtureKey(boot.key.kid); // same kid so JWKS lookup hits, but a different keypair
+    const jwt = boot.signerMod.fixtureAccessJwt({
+      key: wrongKey,
+      profile: { issuer: FIXTURE_ISSUER, audience: FIXTURE_AUDIENCE },
+      principal: { email: 'evil@example.com', sub: 'user:evil' },
+      ttlSec: 60,
+    });
+    const req = new Request('https://cf-edge.fixture/protected', { headers: { 'Cf-Access-Jwt-Assertion': jwt } });
+    const outcome = await validator.middleware(req);
+    subcases.push({
+      name: 'mis-signed',
+      rejected: outcome.rejected,
+      status: outcome.response?.status,
+      auditCount: sink.length,
+      auditOutcome: sink[0]?.outcome,
+      auditKeys: sink[0] ? Object.keys(sink[0]).sort() : null,
+    });
+  }
+
+  // Note the mutation-check pair for the negative fires:
+  // Fires on the shipped code path (no bypass): every rejected===true, status===401, auditCount===1, audit keys drawn from allowed set.
+  // A mutation that removes the sink.push()/early-return call in the missing branch would drop auditCount to 0 (subcase would fail).
+
+  const allowed = ['email', 'outcome', 'path', 'timestamp'];
+  for (const sc of subcases) {
+    const ok = sc.rejected === true && sc.status === 401 && sc.auditCount === 1 && sc.auditKeys && sc.auditKeys.join(',') === allowed.join(',');
+    results.push({
+      anchorAcId: 'AC-34102-1',
+      verdict: ok ? 'pass' : 'fail',
+      detail: ok
+        ? `subcase ${sc.name}: 401 with one audit event, allowed keys only (${sc.auditKeys.join(',')}), outcome=${sc.auditOutcome}`
+        : `subcase ${sc.name} broke: ${JSON.stringify(sc)}`,
+    });
+  }
+
+  await boot.stop();
+  return { results };
+}

package/blueprints/edge-cloudflare-access/contributions/probes/probe-utils.mjs

@@ -0,0 +1,90 @@
+// Shared helpers for edge-cloudflare-access probes.
+//
+// Runtime-dependency posture: probes import the fixture's JWT
+// validator, fixture-JWT signer and JWKS server from the cf-edge
+// fixture src/ and test/ trees so rcf-lite itself gains no new
+// runtime dependency. Four probes drive the shipped code path
+// in-process; one probe (real-account-gated-url) opens a network
+// fetch against the elicited hostname when CI_HAS_CLOUDFLARE_ACCOUNT
+// and CF_ACCESS_HOST are set. Without both env vars it records
+// accountBoundSkipped and aggregates to pass per spec section 3.5.
+//
+// The wrangler dev seam is documented in the fixture README under
+// the "Two-line wrangler-seam boot" section; the wrangler-seam
+// probe drives it under workerd.
+
+import { mkdir, writeFile } from 'node:fs/promises';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+
+export const PROJECT_ROOT = resolve(HERE, '..', '..', '..', '..');
+export const FIXTURE_DIR = resolve(PROJECT_ROOT, 'packages/rcf-lite/test/fixtures/cf-edge');
+export const REPORT_DIR = resolve(PROJECT_ROOT, '.rcf/reports/blueprints/edge-cloudflare-access');
+
+export function aggregate(results) {
+  if (results.some((r) => r.verdict === 'fail')) return 'fail';
+  if (results.some((r) => r.verdict === 'warn')) return 'warn';
+  return 'pass';
+}
+
+export async function writeReport({ probeName, engine, results, extra }) {
+  await mkdir(REPORT_DIR, { recursive: true });
+  const report = {
+    slug: 'edge-cloudflare-access',
+    probeName,
+    runAt: new Date().toISOString(),
+    engine,
+    results,
+    aggregateVerdict: aggregate(results),
+    ...(extra ?? {}),
+  };
+  const path = resolve(REPORT_DIR, `${probeName}.json`);
+  await writeFile(path, JSON.stringify(report, null, 2) + '\n', 'utf8');
+  return { report, path };
+}
+
+// Wraps a probe's async main body and reports. Sets process.exitCode
+// on fail; drains stdout naturally per shelf convention.
+export async function runShim(probeName, engine, mainFn) {
+  try {
+    const { results, extra } = await mainFn();
+    const { report, path } = await writeReport({ probeName, engine, results, extra });
+    process.stdout.write(JSON.stringify(report, null, 2) + '\n');
+    process.stdout.write(`report written to ${path}\n`);
+    if (report.aggregateVerdict === 'fail') process.exitCode = 1;
+  } catch (err) {
+    const results = [{
+      anchorAcId: 'unknown',
+      verdict: 'fail',
+      detail: `probe threw: ${err && err.message ? err.message : String(err)}`,
+    }];
+    const { report, path } = await writeReport({ probeName, engine, results });
+    process.stdout.write(JSON.stringify(report, null, 2) + '\n');
+    process.stderr.write(`probe error: ${err && err.stack ? err.stack : String(err)}\n`);
+    process.stderr.write(`report written to ${path}\n`);
+    process.exitCode = 1;
+  }
+}
+
+// Boot a fixture JWT keypair + JWKS server on 127.0.0.1:0 and
+// return {key, server, jwksUrl, stop}.
+export async function bootFixtureJwks(kid = 'cf-edge-fixture-kid-1') {
+  const signerMod = await import(`${FIXTURE_DIR}/test/jwt-signer.mjs`);
+  const jwksMod = await import(`${FIXTURE_DIR}/test/jwks-server.mjs`);
+  const key = signerMod.createFixtureKey(kid);
+  const server = await jwksMod.startJwksServer({ port: 0, keys: [key] });
+  return { key, server, signerMod, jwksUrl: server.url, stop: () => server.stop() };
+}
+
+export async function loadValidator() {
+  return (await import(`${FIXTURE_DIR}/src/jwt-validator.mjs`)).createAccessValidator;
+}
+
+export function fixtureEnv(jwksUrl, audience = 'cf-edge-fixture-audience') {
+  return { ACCESS_JWKS_URL: jwksUrl, ACCESS_AUDIENCE: audience };
+}
+
+export const FIXTURE_AUDIENCE = 'cf-edge-fixture-audience';
+export const FIXTURE_ISSUER = 'https://cf-edge-fixture.cloudflareaccess.test';

package/blueprints/edge-cloudflare-access/contributions/probes/real-account-gated-url.mjs

@@ -0,0 +1,65 @@
+// Probe: real-account gated URL round-trip against a scheduled Access-configured hostname.
+// anchorAcId: AC-34109-1. accountBound: true.
+//
+// When CI_HAS_CLOUDFLARE_ACCOUNT and CF_ACCESS_HOST are set, the probe fetches
+// https://<host>/ with redirects disabled and walks up to five redirect hops,
+// asserting the terminal Location points at https://<team>.cloudflareaccess.com/.
+// Without either env var the probe records accountBoundSkipped: true and
+// aggregates to pass per spec section 3.5 (pass-with-skip).
+
+export const anchorAcId = 'AC-34109-1';
+export const accountBound = true;
+
+const MAX_HOPS = 5;
+
+async function walkRedirects(url) {
+  const chain = [];
+  let current = url;
+  for (let hop = 0; hop < MAX_HOPS; hop++) {
+    const res = await fetch(current, { redirect: 'manual' });
+    const location = res.headers.get('location');
+    chain.push({ url: current, status: res.status, location });
+    if (res.status < 300 || res.status >= 400 || !location) break;
+    current = new URL(location, current).toString();
+  }
+  return { chain, terminal: chain[chain.length - 1] };
+}
+
+export default async function runProbe() {
+  const has = process.env.CI_HAS_CLOUDFLARE_ACCOUNT === 'true';
+  const host = process.env.CF_ACCESS_HOST || '';
+  if (!has || !host) {
+    return {
+      results: [{
+        anchorAcId: 'AC-34109-1',
+        verdict: 'pass',
+        accountBoundSkipped: true,
+        detail: `accountBoundSkipped: CI_HAS_CLOUDFLARE_ACCOUNT=${has} CF_ACCESS_HOST=${host ? 'set' : 'unset'}; per spec section 3.5 pass-with-skip.`,
+      }],
+      extra: { accountBoundSkipped: true },
+    };
+  }
+  try {
+    const { chain, terminal } = await walkRedirects(`https://${host}/`);
+    const terminalUrl = terminal.location ?? terminal.url;
+    const ok = /https?:\/\/[a-z0-9-]+\.cloudflareaccess\.com/i.test(terminalUrl);
+    return {
+      results: [{
+        anchorAcId: 'AC-34109-1',
+        verdict: ok ? 'pass' : 'fail',
+        detail: ok
+          ? `redirect chain terminated at cloudflareaccess.com; hops=${chain.length} terminal=${terminalUrl}`
+          : `redirect chain did not terminate at cloudflareaccess.com; chain=${JSON.stringify(chain)}`,
+      }],
+      extra: { accountBound: true, chainLength: chain.length },
+    };
+  } catch (err) {
+    return {
+      results: [{
+        anchorAcId: 'AC-34109-1',
+        verdict: 'fail',
+        detail: `real-account probe threw: ${err && err.message ? err.message : String(err)}`,
+      }],
+    };
+  }
+}

package/blueprints/edge-cloudflare-access/contributions/probes/run-admin-console-gate-surface.mjs

@@ -0,0 +1,5 @@
+import runProbe from './admin-console-gate-surface.mjs';
+import { runShim } from './probe-utils.mjs';
+
+const engine = { kind: 'admin-console-fixture', image: 'node HTTP fixture (probe-pack-application-admin-console)', healthy: true };
+runShim('admin-console-gate-surface', engine, runProbe);

package/blueprints/edge-cloudflare-access/contributions/probes/run-audit-event-secrecy.mjs

@@ -0,0 +1,5 @@
+import runProbe from './audit-event-secrecy.mjs';
+import { runShim } from './probe-utils.mjs';
+
+const engine = { kind: 'in-process', image: 'in-process JWT validator on cf-edge fixture', healthy: true };
+runShim('audit-event-secrecy', engine, runProbe);

package/blueprints/edge-cloudflare-access/contributions/probes/run-jwt-validator-fixture.mjs

@@ -0,0 +1,5 @@
+import runProbe from './jwt-validator-fixture.mjs';
+import { runShim } from './probe-utils.mjs';
+
+const engine = { kind: 'in-process', image: 'in-process JWT validator on cf-edge fixture', healthy: true };
+runShim('jwt-validator-fixture', engine, runProbe);

package/blueprints/edge-cloudflare-access/contributions/probes/run-jwt-validator-reject.mjs

@@ -0,0 +1,5 @@
+import runProbe from './jwt-validator-reject.mjs';
+import { runShim } from './probe-utils.mjs';
+
+const engine = { kind: 'in-process', image: 'in-process JWT validator on cf-edge fixture', healthy: true };
+runShim('jwt-validator-reject', engine, runProbe);

package/blueprints/edge-cloudflare-access/contributions/probes/run-real-account-gated-url.mjs

@@ -0,0 +1,5 @@
+import runProbe from './real-account-gated-url.mjs';
+import { runShim } from './probe-utils.mjs';
+
+const engine = { kind: 'real-account', image: 'live fetch against Cloudflare Access-configured hostname', healthy: true };
+runShim('real-account-gated-url', engine, runProbe);

package/blueprints/edge-cloudflare-access/contributions/probes/run-wrangler-seam.mjs

@@ -0,0 +1,5 @@
+import runProbe from './wrangler-seam.mjs';
+import { runShim } from './probe-utils.mjs';
+
+const engine = { kind: 'wrangler-dev', image: 'wrangler dev (workerd) on cf-edge fixture', healthy: true };
+runShim('wrangler-seam', engine, runProbe);

package/blueprints/edge-cloudflare-access/contributions/probes/wrangler-seam.mjs

@@ -0,0 +1,203 @@
+// Wrangler-seam probe for edge-cloudflare-access v1.0.0.
+//
+// Spawns `wrangler dev --local` on the cf-edge fixture and drives
+// three requests to observe the JWT validator at the edge under
+// workerd:
+//
+// (a) a missing-header request to /protected returns HTTP 401
+//     (the validator's reject path runs through the shipped Worker
+//     entry, not through the in-process probes).
+// (b) a request to /protected carrying a fixture-signed JWT that
+//     the fixture JWKS server (booted by this probe on the fixed
+//     port from wrangler.toml [vars] ACCESS_JWKS_URL) validates
+//     returns HTTP 200 with request.auth reflected on the response
+//     body.
+// (c) a request to /health returns HTTP 200 (the /health path is
+//     exempt from the validator so a load balancer can reach it).
+//
+// Warn semantics per spec section 3.1 pass-with-skip:
+//   - wrangler devDependency missing: aggregateVerdict warn (never fail);
+//   - wrangler CLI fails to bind within the cap: warn.
+//   - A handler thrown at the workerd boundary: fail (per round-6 T-3 gate).
+//
+// Mutation-check pair for the negative fires: removing the
+// validator's early-return call on missing header would surface
+// the /protected request as HTTP 200 with no request.auth (an
+// unauthenticated request reaching the handler). The probe fails
+// on that mutation: HTTP 401 is required. See PR body for the
+// verbatim tails of the shipped-path pass and the mutation-run
+// fail.
+
+import { spawn } from 'node:child_process';
+import { existsSync } from 'node:fs';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+
+export const anchorAcId = 'AC-34101-1';
+export const accountBound = false;
+
+const BIND_CAP_MS = 60000;
+const KILL_GRACE_MS = 2000;
+// The fixture wrangler.toml [vars] ACCESS_JWKS_URL points at 127.0.0.1:8788
+// per the shipped file. The wrangler-seam probe boots the JWKS server on
+// exactly that port so the validator hits it under workerd.
+const JWKS_PORT = 8788;
+const FIXTURE_AUDIENCE = 'cf-edge-fixture-audience';
+const FIXTURE_ISSUER = 'https://cf-edge-fixture.cloudflareaccess.test';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+const FIXTURE_DIR = resolve(HERE, '..', '..', '..', '..', 'packages', 'rcf-lite', 'test', 'fixtures', 'cf-edge');
+
+function findWranglerBin() {
+  const candidate = resolve(FIXTURE_DIR, 'node_modules', '.bin', 'wrangler');
+  return existsSync(candidate) ? candidate : null;
+}
+
+async function killAndDrain(proc) {
+  if (!proc || proc.killed) return;
+  try { proc.kill('SIGTERM'); } catch (_e) {}
+  await new Promise((r) => setTimeout(r, KILL_GRACE_MS));
+  try { if (!proc.killed) proc.kill('SIGKILL'); } catch (_e) {}
+}
+
+export default async function runProbe() {
+  const results = [];
+  const bin = findWranglerBin();
+  if (!bin) {
+    results.push({
+      anchorAcId: 'AC-34101-1',
+      verdict: 'warn',
+      detail: `wrangler devDependency not installed under ${FIXTURE_DIR}/node_modules/.bin/wrangler; run pnpm install --ignore-workspace in the fixture directory. Mechanism-reach gap noted; the in-process probes carry the runtime evidence for the shipped validator. Warn (not fail) per section 3.1 pass-with-skip.`,
+    });
+    return { results, extra: { wranglerBinPresent: false } };
+  }
+
+  // Boot the fixture JWKS server on the fixed port from wrangler.toml.
+  const signerMod = await import(pathToFileURL(resolve(FIXTURE_DIR, 'test', 'jwt-signer.mjs')).href);
+  const jwksMod = await import(pathToFileURL(resolve(FIXTURE_DIR, 'test', 'jwks-server.mjs')).href);
+  const key = signerMod.createFixtureKey('cf-edge-wrangler-seam-kid');
+  let jwks;
+  try {
+    jwks = await jwksMod.startJwksServer({ port: JWKS_PORT, keys: [key] });
+  } catch (err) {
+    results.push({
+      anchorAcId: 'AC-34101-1',
+      verdict: 'warn',
+      detail: `local JWKS server could not bind port ${JWKS_PORT}: ${err && err.message ? err.message : String(err)}. Warn (not fail): the JWKS port is required for the wrangler-seam probe to observe the validator's positive path under workerd. Fix by freeing port ${JWKS_PORT} and re-running.`,
+    });
+    return { results, extra: { wranglerBinPresent: true, jwksBound: false } };
+  }
+
+  const proc = spawn(bin, ['dev', '--local', '--port', '0'], {
+    cwd: FIXTURE_DIR,
+    env: process.env,
+    stdio: ['ignore', 'pipe', 'pipe'],
+  });
+
+  let boundUrl = null;
+  let stderrTail = '';
+  let stdoutTail = '';
+  proc.stdout.on('data', (buf) => {
+    const s = buf.toString();
+    stdoutTail = (stdoutTail + s).slice(-2000);
+    const m = s.match(/Ready on http:\/\/(?:127\.0\.0\.1|localhost):(\d+)/i);
+    if (m && !boundUrl) boundUrl = `http://127.0.0.1:${m[1]}`;
+  });
+  proc.stderr.on('data', (b) => { stderrTail = (stderrTail + b.toString()).slice(-2000); });
+
+  const start = Date.now();
+  while (!boundUrl && Date.now() - start < BIND_CAP_MS) {
+    if (proc.exitCode !== null) break;
+    await new Promise((r) => setTimeout(r, 250));
+  }
+
+  if (!boundUrl) {
+    await killAndDrain(proc);
+    await jwks.stop();
+    results.push({
+      anchorAcId: 'AC-34101-1',
+      verdict: 'warn',
+      detail: `wrangler dev did not bind within ${BIND_CAP_MS}ms; stdoutTail: ${stdoutTail.slice(-400)} stderrTail: ${stderrTail.slice(-400)}. Warn (not fail) per section 3.1 pass-with-skip.`,
+    });
+    return { results, extra: { wranglerBinPresent: true, boundUrl: null } };
+  }
+
+  try {
+    // (a) missing header on /protected -> 401
+    let statusMissing = 0;
+    try {
+      const r = await fetch(`${boundUrl}/protected`);
+      statusMissing = r.status;
+    } catch (err) {
+      results.push({
+        anchorAcId: 'AC-34101-1',
+        verdict: 'fail',
+        detail: `handler thrown at the workerd boundary on /protected: ${err && err.message ? err.message : String(err)}`,
+      });
+      return { results, extra: { wranglerBinPresent: true, boundUrl } };
+    }
+    results.push({
+      anchorAcId: 'AC-34101-1',
+      verdict: statusMissing === 401 ? 'pass' : 'fail',
+      detail: statusMissing === 401
+        ? `workerd /protected (no header) returned HTTP 401 - the shipped validator's missing-header reject path fires at the edge`
+        : `workerd /protected (no header) returned HTTP ${statusMissing}; expected 401 on the shipped validator's missing-header reject path (a value other than 401 would surface an unauthenticated request to the handler - the exact mutation the probe guards against)`,
+    });
+
+    // (b) valid fixture-signed JWT on /protected -> 200 with request.auth
+    const jwt = signerMod.fixtureAccessJwt({
+      key,
+      profile: { issuer: FIXTURE_ISSUER, audience: FIXTURE_AUDIENCE },
+      principal: { email: 'ada@example.com', sub: 'user:ada', groups: ['admins'] },
+      ttlSec: 60,
+    });
+    let signedStatus = 0;
+    let signedBody = '';
+    try {
+      const r = await fetch(`${boundUrl}/protected`, { headers: { 'Cf-Access-Jwt-Assertion': jwt } });
+      signedStatus = r.status;
+      signedBody = await r.text();
+    } catch (err) {
+      results.push({
+        anchorAcId: 'AC-34101-1',
+        verdict: 'fail',
+        detail: `handler thrown at the workerd boundary on signed /protected: ${err && err.message ? err.message : String(err)}`,
+      });
+      return { results, extra: { wranglerBinPresent: true, boundUrl } };
+    }
+    const authLeaked = signedStatus === 200 && signedBody.includes('"auth"') && signedBody.includes('"email":"ada@example.com"');
+    results.push({
+      anchorAcId: 'AC-34101-1',
+      verdict: authLeaked ? 'pass' : 'fail',
+      detail: authLeaked
+        ? `workerd /protected (fixture-signed JWT) returned HTTP 200 with request.auth reflected on the body (email=ada@example.com)`
+        : `workerd /protected (fixture-signed JWT) failed: status=${signedStatus} body=${signedBody.slice(0, 200)}`,
+    });
+
+    // (c) /health -> 200
+    let healthStatus = 0;
+    try {
+      const r = await fetch(`${boundUrl}/health`);
+      healthStatus = r.status;
+    } catch (err) {
+      results.push({
+        anchorAcId: 'AC-34101-1',
+        verdict: 'fail',
+        detail: `handler thrown at the workerd boundary on /health: ${err && err.message ? err.message : String(err)}`,
+      });
+      return { results, extra: { wranglerBinPresent: true, boundUrl } };
+    }
+    results.push({
+      anchorAcId: 'AC-34101-1',
+      verdict: healthStatus === 200 ? 'pass' : 'fail',
+      detail: healthStatus === 200
+        ? `workerd /health returned HTTP 200 (health path exempt from the validator, LB-reachable)`
+        : `workerd /health returned HTTP ${healthStatus}; expected 200`,
+    });
+  } finally {
+    await killAndDrain(proc);
+    await jwks.stop();
+  }
+
+  return { results, extra: { wranglerBinPresent: true, boundUrl } };
+}

package/blueprints/edge-cloudflare-access/contributions/requirements/edge-cloudflare-access-req-001.json

@@ -0,0 +1,17 @@
+{
+  "reqId": "edge-cloudflare-access-REQ-001",
+  "prdId": "PRD-001",
+  "title": "The Access JWT validator is the sole reader of the Cf-Access-Jwt-Assertion header and reduces the principal onto request.auth",
+  "description": "The applying project reaches Cloudflare Access through a single JWT validator module (src/jwt-validator.mjs) that is the ONLY module dereferencing the Cf-Access-Jwt-Assertion header in the applied source tree per https://developers.cloudflare.com/cloudflare-one/policies/access/. The validator fetches the Access JWKS from the elicited endpoint, caches keys per-kid, verifies the JWT against the cached key matching the header's kid, and reduces the principal into request.auth as {email, sub, groups}. Every downstream handler reads request.auth only; no other module reaches the header.",
+  "category": "functional",
+  "domain": "edge",
+  "priority": "must",
+  "rationale": "Ratified in the Cloudflare round 6 spec (2026-09-06 section 5.4). Ships as v1.0.0 of edge-cloudflare-access.",
+  "tags": [
+    "blueprint:edge-cloudflare-access"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-07T16:00:00.000Z",
+  "updatedAt": "2026-09-07T16:00:00.000Z"
+}

package/blueprints/edge-cloudflare-access/contributions/requirements/edge-cloudflare-access-req-002.json

@@ -0,0 +1,17 @@
+{
+  "reqId": "edge-cloudflare-access-REQ-002",
+  "prdId": "PRD-001",
+  "title": "An Access application is declared with an elicited hostname or self-hosted-app id and an elicited policy shape from the enum",
+  "description": "The blueprint elicits either an Access application hostname or a self-hosted-app id (one of the two) plus the JWT audience tag and JWKS URL, plus a policy shape from the enum (email-domain, service-token-only, service-token-plus-email-domain, group-membership). Applying the blueprint records the elicited values on rcf/blueprints/edge-cloudflare-access.applied.json; the shipped guide walks the operator through issuing the paired policy in the Cloudflare Zero Trust dashboard (screen-by-screen) and documents the alternative API path against api.cloudflare.com/client/v4/accounts/{account_id}/access/apps/{app_id}/policies.",
+  "category": "functional",
+  "domain": "edge",
+  "priority": "must",
+  "rationale": "Ratified in the Cloudflare round 6 spec (2026-09-06 section 5.4). Ships as v1.0.0 of edge-cloudflare-access.",
+  "tags": [
+    "blueprint:edge-cloudflare-access"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-07T16:00:00.000Z",
+  "updatedAt": "2026-09-07T16:00:00.000Z"
+}