rcf-lite 0.23.0 → 0.24.0

package/blueprints/edge-cloudflare-access/contributions/requirements/edge-cloudflare-access-req-003.json

@@ -0,0 +1,17 @@
+{
+  "reqId": "edge-cloudflare-access-REQ-003",
+  "prdId": "PRD-001",
+  "title": "The operator issues a Zero Trust policy via the guide's dashboard walk-through or the alternative API path",
+  "description": "The shipped guide documents two paths for issuing the Zero Trust policy that the shipped validator enforces: (1) a screen-by-screen walk-through of the Cloudflare Zero Trust dashboard for the operator picking hostname-scoped or self-hosted applications, per https://developers.cloudflare.com/cloudflare-one/policies/access/; and (2) a curl example against https://api.cloudflare.com/client/v4/accounts/{account_id}/access/apps/{app_id}/policies for the operator preferring API automation. The API path is idempotent per Cloudflare's documented semantics; the dashboard path is not.",
+  "category": "functional",
+  "domain": "edge",
+  "priority": "must",
+  "rationale": "Ratified in the Cloudflare round 6 spec (2026-09-06 section 5.4). Ships as v1.0.0 of edge-cloudflare-access.",
+  "tags": [
+    "blueprint:edge-cloudflare-access"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-07T16:00:00.000Z",
+  "updatedAt": "2026-09-07T16:00:00.000Z"
+}

package/blueprints/edge-cloudflare-access/contributions/requirements/edge-cloudflare-access-req-004.json

@@ -0,0 +1,17 @@
+{
+  "reqId": "edge-cloudflare-access-REQ-004",
+  "prdId": "PRD-001",
+  "title": "The audit event carries only metadata fields (email, outcome, timestamp, path) with no token value and no header names beyond path",
+  "description": "Every validate-pass, validate-reject and bypass emits exactly one audit event on the injected sink with the metadata-only shape {email, outcome, timestamp, path}. The record is Object.frozen at the validator boundary so no downstream module can enrich it with a stray token slice or header value. The serialised JSON of every record contains no substring of the JWT (header, payload or signature), no Authorization value, and no header names beyond path.",
+  "category": "functional",
+  "domain": "edge",
+  "priority": "must",
+  "rationale": "Ratified in the Cloudflare round 6 spec (2026-09-06 section 5.4). Ships as v1.0.0 of edge-cloudflare-access.",
+  "tags": [
+    "blueprint:edge-cloudflare-access"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-07T16:00:00.000Z",
+  "updatedAt": "2026-09-07T16:00:00.000Z"
+}

package/blueprints/edge-cloudflare-access/contributions/requirements/edge-cloudflare-access-req-005.json

@@ -0,0 +1,17 @@
+{
+  "reqId": "edge-cloudflare-access-REQ-005",
+  "prdId": "PRD-001",
+  "title": "Break-glass posture: an elicited bypass-service-auth token pair authenticates CI automation with a distinct audit outcome",
+  "description": "The operator elicits a break-glass service-auth id (blueprint.json elicit access-bypass-service-auth-id) and a paired secret delegated to the applied security-secrets-management vault seam. When a request presents CF-Access-Client-Id and CF-Access-Client-Secret matching the elicited pair (or SIMULATE_BYPASS_SERVICE_AUTH forces the code path), the validator observes the pair, records outcome=bypass with the same metadata-only shape, and delegates to the handler with request.auth.email='service:'+id. Without an elicited pair the break-glass code path is disabled.",
+  "category": "functional",
+  "domain": "edge",
+  "priority": "must",
+  "rationale": "Ratified in the Cloudflare round 6 spec (2026-09-06 section 5.4). Ships as v1.0.0 of edge-cloudflare-access.",
+  "tags": [
+    "blueprint:edge-cloudflare-access"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-07T16:00:00.000Z",
+  "updatedAt": "2026-09-07T16:00:00.000Z"
+}

package/blueprints/edge-cloudflare-access/contributions/requirements/edge-cloudflare-access-req-006.json

@@ -0,0 +1,18 @@
+{
+  "reqId": "edge-cloudflare-access-REQ-006",
+  "prdId": "PRD-001",
+  "title": "Composition with application-admin-console v1.1.0: the sign-in surface flips per applied capability set",
+  "description": "When application-admin-console v1.1.0 is applied alongside edge-cloudflare-access, the admin-console reads the appliedCapabilities set at apply-time (via the shipped readAppliedCapabilities helper, the T-5 visual-round mechanism); with zeroTrustGate in the set the admin-console renders the Access-gated sign-in surface (data-surface=access-gated, no [data-surface=local-login], a [data-role=principal-read] with the request.auth email); without zeroTrustGate the admin-console falls back to whatever security-auth-* is applied (data-surface=local-login). The composition is deterministic; the pack check AC-21815-1 on the shipped application-admin-console.pack.mjs enforces the gated branch.",
+  "category": "functional",
+  "domain": "edge",
+  "priority": "must",
+  "rationale": "Ratified in the Cloudflare round 6 spec (2026-09-06 section 5.4 plus section 5.4.1 admin-console v1.1.0 delta; spec section 1 ruling 7). Ships as v1.0.0 of edge-cloudflare-access and v1.1.0 of application-admin-console in the same PR (round-4 T-4 capability-minor pattern).",
+  "tags": [
+    "blueprint:edge-cloudflare-access",
+    "blueprint:application-admin-console"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-07T16:00:00.000Z",
+  "updatedAt": "2026-09-07T16:00:00.000Z"
+}

package/blueprints/edge-cloudflare-access/contributions/tacs/tac-3501-edge-cloudflare-access-jwt-validator.json

@@ -0,0 +1,31 @@
+{
+  "tacId": "TAC-3501-edge-cloudflare-access-jwt-validator",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "name": "Access JWT validator with JWKS fetch and cache",
+  "purpose": "The single project-side module realising the Access JWT validator middleware. It is the sole reader of the Cf-Access-Jwt-Assertion header per REQ-001. Fetches the JWKS from env.ACCESS_JWKS_URL, caches keys per-kid for the elicited cache window, verifies the JWT against the cached key matching the header's kid, reduces the principal into request.auth as {email, sub, groups} and returns 401 on any validate-failure with a metadata-only audit event on the injected sink. Consumers never touch the header outside this module; the middleware is the one place the vendor surface lives so a future adapter (Google Cloud IAP, Duo Access) slots in without a consumer re-shape.",
+  "responsibilities": [
+    "Export createAccessValidator({env, eventSink, fetch, clock, bypassServiceAuth}) returning {validate, middleware} matching the Cloudflare Access JWT validation shape (AC-34101-1, AC-34102-1).",
+    "Own the ONLY reference to the Cf-Access-Jwt-Assertion header string in the applied source tree (AC-34103-1).",
+    "Emit exactly one audit event per validate outcome on the injected sink with the metadata-only shape {email, outcome, timestamp, path} (AC-34106-1).",
+    "Recognise the CF-Access-Client-Id / CF-Access-Client-Secret paired headers as break-glass when the elicited bypass-service-auth pair is applied, and route through with outcome=bypass (AC-34107-1)."
+  ],
+  "internalStructure": "One module (src/jwt-validator.mjs) exporting createAccessValidator. The middleware wires a fetch-shaped JWKS fetcher, a per-kid Map cache with a 60-second TTL and an audit sink boundary. The audit record is Object.frozen at the boundary so a downstream handler cannot enrich it with a stray token slice.",
+  "interfaces": [
+    {
+      "name": "createAccessValidator",
+      "kind": "factory",
+      "summary": "Access JWT validator factory over env.ACCESS_JWKS_URL and env.ACCESS_AUDIENCE."
+    },
+    {
+      "name": "validator.middleware",
+      "kind": "method",
+      "summary": "Handler-shaped middleware that either returns a rejection Response or attaches request.auth and returns rejected:false."
+    }
+  ],
+  "dependencies": [],
+  "createdAt": "2026-09-07T16:00:00.000Z",
+  "updatedAt": "2026-09-07T16:00:00.000Z"
+}

package/blueprints/edge-cloudflare-access/contributions/tacs/tac-3502-edge-cloudflare-access-application-declaration.json

@@ -0,0 +1,33 @@
+{
+  "tacId": "TAC-3502-edge-cloudflare-access-application-declaration",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "name": "Access application declaration surface",
+  "purpose": "The apply-time surface that captures the operator's Access application declaration: hostname or self-hosted-app id, JWT audience, JWKS URL, policy shape and (optionally) the break-glass service-auth pair. The declaration lands verbatim on rcf/blueprints/edge-cloudflare-access.applied.json so the shipped guide's dashboard walk-through and API alternative both operate on the same values.",
+  "responsibilities": [
+    "Elicit access-application-host OR access-selfhosted-app-id (exactly one is required at apply).",
+    "Elicit access-audience, access-jwks-url and access-policy-shape (from the enum in TAC-3503).",
+    "Elicit access-bypass-service-auth-id (blank disables break-glass); delegate the paired secret to the applied security-secrets-management vault seam.",
+    "Persist the elicited values on the applied-sidecar for the guide walk-through, the composition read from admin-console v1.1.0 and the sole-reader-scan probe."
+  ],
+  "internalStructure": "Declarative: the blueprint.json elicits[] block plus the applied-sidecar. The blueprint declares no runtime code path for the declaration surface itself; every consumer of the declaration reads the applied-sidecar via the shared readAppliedCapabilities helper.",
+  "interfaces": [
+    {
+      "name": "rcf/blueprints/edge-cloudflare-access.applied.json",
+      "kind": "artifact",
+      "summary": "The apply-time sidecar carrying the elicited declaration."
+    }
+  ],
+  "dependencies": [
+    {
+      "name": "TAC-3503 policy shape enum",
+      "kind": "tac",
+      "tacId": "TAC-3503-edge-cloudflare-access-policy-shape",
+      "description": "The policy-shape elicitation resolves to one of the enum values named in TAC-3503."
+    }
+  ],
+  "createdAt": "2026-09-07T16:00:00.000Z",
+  "updatedAt": "2026-09-07T16:00:00.000Z"
+}

package/blueprints/edge-cloudflare-access/contributions/tacs/tac-3503-edge-cloudflare-access-policy-shape.json

@@ -0,0 +1,25 @@
+{
+  "tacId": "TAC-3503-edge-cloudflare-access-policy-shape",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "name": "Access policy shape enum and its issuance flow",
+  "purpose": "Names the four policy shapes the blueprint supports: email-domain, service-token-only, service-token-plus-email-domain and group-membership. The guide walks each shape through the Cloudflare Zero Trust dashboard and documents the API alternative against api.cloudflare.com/client/v4/accounts/{account_id}/access/apps/{app_id}/policies per https://developers.cloudflare.com/cloudflare-one/policies/access/. A shape outside the enum is refused at apply.",
+  "responsibilities": [
+    "Enumerate the four shipped policy shapes.",
+    "Document the dashboard walk-through and the API alternative for each shape in the guide (AC-34105-1).",
+    "Name the audit outcome each shape emits on validate-pass (validated) and validate-reject (missing, expired, invalid)."
+  ],
+  "internalStructure": "Enum in blueprint.json elicits[]; the applied-sidecar records the operator's choice. The validator does not branch on the policy shape at runtime (the Cloudflare edge enforces the policy); the shape drives the guide's operator flow and the applied-sidecar seam the composition reads.",
+  "interfaces": [
+    {
+      "name": "access-policy-shape elicit",
+      "kind": "enum",
+      "summary": "email-domain | service-token-only | service-token-plus-email-domain | group-membership."
+    }
+  ],
+  "dependencies": [],
+  "createdAt": "2026-09-07T16:00:00.000Z",
+  "updatedAt": "2026-09-07T16:00:00.000Z"
+}

package/blueprints/edge-cloudflare-access/contributions/tacs/tac-3504-edge-cloudflare-access-audit-sink.json

@@ -0,0 +1,25 @@
+{
+  "tacId": "TAC-3504-edge-cloudflare-access-audit-sink",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "name": "Access audit sink with metadata-only shape",
+  "purpose": "Names the audit-event contract every validator outcome writes through the injected sink. The record shape is exactly {email, outcome, timestamp, path}; the sink boundary Object.freezes the record so a downstream handler cannot enrich it with a stray token slice. Retention and long-term storage are delegated to the applied logging companion per ADR-3504.",
+  "responsibilities": [
+    "Emit exactly one audit event per validate outcome on the injected sink (AC-34106-1).",
+    "Freeze the record at the boundary so no downstream handler can add a token substring or header value (AC-34106-1).",
+    "Support four outcomes: validated (pass), missing, expired, invalid (reject) and bypass (break-glass)."
+  ],
+  "internalStructure": "One helper (auditRecord) inside src/jwt-validator.mjs constructing the frozen four-key record. The sink itself is a caller-supplied function; a production consumer wires this to the applied logging companion (whose retention policy binds).",
+  "interfaces": [
+    {
+      "name": "eventSink",
+      "kind": "callback",
+      "summary": "A function accepting one audit record per validator outcome."
+    }
+  ],
+  "dependencies": [],
+  "createdAt": "2026-09-07T16:00:00.000Z",
+  "updatedAt": "2026-09-07T16:00:00.000Z"
+}

package/blueprints/edge-cloudflare-access/contributions/user-stories/edge-cloudflare-access-us-34101.json

@@ -0,0 +1,27 @@
+{
+  "usId": "edge-cloudflare-access-US-34101",
+  "prdId": "PRD-001",
+  "reqId": "edge-cloudflare-access-REQ-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Fixture-signed JWT validates and principal reduces onto request.auth",
+  "asA": "shelf consumer applying the edge-cloudflare-access v1.0.0 blueprint on a Workers project using the cf-edge fixture",
+  "iWant": "the Cf-Access-Jwt-Assertion header validated against the fixture Access JWKS on every request, the principal reduced into request.auth as {email, sub, groups} and the downstream handler observes 200 with the reduced principal fields",
+  "soThat": "the Worker only ever sees authenticated principals and downstream code reads a single stable seam for identity",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-34101-1",
+      "description": "The JWT validator reads Cf-Access-Jwt-Assertion, verifies against the fixture JWKS (RS256, kid rotation supported by the per-kid cache), reduces the principal into request.auth as {email, sub, groups} and the downstream handler receives a 200 with the reduced principal fields exposed on request.auth.",
+      "given": "a Worker fetch handler wired with createAccessValidator(...).middleware and a fixture-signed JWT presented in the Cf-Access-Jwt-Assertion header",
+      "when": "the request dispatches through the validator",
+      "then": "the validator resolves, attaches {email, sub, groups} onto request.auth and delegates to the handler which returns 200 with the reduced principal reflected on the response body",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-3501-edge-cloudflare-access-jwt-validator"
+  ],
+  "createdAt": "2026-09-07T16:00:00.000Z",
+  "updatedAt": "2026-09-07T16:00:00.000Z"
+}

package/blueprints/edge-cloudflare-access/contributions/user-stories/edge-cloudflare-access-us-34102.json

@@ -0,0 +1,28 @@
+{
+  "usId": "edge-cloudflare-access-US-34102",
+  "prdId": "PRD-001",
+  "reqId": "edge-cloudflare-access-REQ-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Missing, expired or mis-signed JWT rejects 401 with a metadata-only audit event",
+  "asA": "shelf consumer applying the edge-cloudflare-access v1.0.0 blueprint on a Workers project using the cf-edge fixture",
+  "iWant": "requests carrying a missing, expired or mis-signed JWT to reject with 401 and emit exactly one metadata-only audit event on the shipped audit sink",
+  "soThat": "unauthenticated traffic cannot reach the downstream handler and every reject is observable without leaking the token value",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-34102-1",
+      "description": "The three reject subcases (missing header, expired exp, mis-signed) each return HTTP 401 and emit exactly one audit event whose keys are drawn from {email, outcome, timestamp, path} with no token substring, no header names beyond path, and no additional keys.",
+      "given": "a Worker fetch handler wired with createAccessValidator(...).middleware and one of the three reject subcases",
+      "when": "the request dispatches through the validator",
+      "then": "the validator returns 401 and emits one audit event whose outcome is drawn from {missing, expired, invalid} with the allowed-key shape",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-3501-edge-cloudflare-access-jwt-validator",
+    "TAC-3504-edge-cloudflare-access-audit-sink"
+  ],
+  "createdAt": "2026-09-07T16:00:00.000Z",
+  "updatedAt": "2026-09-07T16:00:00.000Z"
+}

package/blueprints/edge-cloudflare-access/contributions/user-stories/edge-cloudflare-access-us-34103.json

@@ -0,0 +1,27 @@
+{
+  "usId": "edge-cloudflare-access-US-34103",
+  "prdId": "PRD-001",
+  "reqId": "edge-cloudflare-access-REQ-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Sole-reader guarantee: src/jwt-validator.mjs is the only module reading the Cf-Access-Jwt-Assertion header",
+  "asA": "shelf consumer applying the edge-cloudflare-access v1.0.0 blueprint on a Workers project using the cf-edge fixture",
+  "iWant": "only src/jwt-validator.mjs to dereference the Cf-Access-Jwt-Assertion header string in the applied source tree",
+  "soThat": "the validator is the single seam and a stray header read in the applied code is a defect the AST scan catches",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-34103-1",
+      "description": "The sole-reader scan walks the fixture applied source root (src/**/*.mjs), strips comments and string literals, and finds exactly one live-source occurrence of the header string Cf-Access-Jwt-Assertion, in src/jwt-validator.mjs. Any other live-source occurrence in a shipped module fails the probe (SIMULATE_NON_VALIDATOR_HEADER=true injects a second hit and the probe fails).",
+      "given": "the cf-edge fixture applied source tree",
+      "when": "the sole-reader-scan probe walks src/**/*.mjs",
+      "then": "the only live-source hit for Cf-Access-Jwt-Assertion is in src/jwt-validator.mjs",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-3501-edge-cloudflare-access-jwt-validator"
+  ],
+  "createdAt": "2026-09-07T16:00:00.000Z",
+  "updatedAt": "2026-09-07T16:00:00.000Z"
+}

package/blueprints/edge-cloudflare-access/contributions/user-stories/edge-cloudflare-access-us-34104.json

@@ -0,0 +1,27 @@
+{
+  "usId": "edge-cloudflare-access-US-34104",
+  "prdId": "PRD-001",
+  "reqId": "edge-cloudflare-access-REQ-002",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Access application declared with elicited hostname or self-hosted-app id and elicited policy shape",
+  "asA": "operator applying the edge-cloudflare-access v1.0.0 blueprint",
+  "iWant": "the blueprint to elicit either an Access application hostname or a self-hosted-app id (one of the two), plus a policy shape from the enum",
+  "soThat": "the apply record captures the exact Access application declaration the operator will issue in the Zero Trust dashboard or over the API",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-34104-1",
+      "description": "blueprint.json elicits access-application-host (kind string) and access-selfhosted-app-id (kind string; the operator supplies exactly one), plus access-audience (kind string), access-jwks-url (kind string), access-policy-shape (kind enum with options email-domain, service-token-only, service-token-plus-email-domain, group-membership; recommended default email-domain) and access-bypass-service-auth-id (kind string; blank disables break-glass). Applying the blueprint records the elicited values on rcf/blueprints/edge-cloudflare-access.applied.json.",
+      "given": "the blueprint.json elicits block",
+      "when": "the apply verb runs against a fixture project",
+      "then": "rcf/blueprints/edge-cloudflare-access.applied.json carries the elicited values plus appliedCapabilities=[zeroTrustGate]",
+      "testable": true,
+      "scope": "library"
+    }
+  ],
+  "tacIds": [
+    "TAC-3502-edge-cloudflare-access-application-declaration"
+  ],
+  "createdAt": "2026-09-07T16:00:00.000Z",
+  "updatedAt": "2026-09-07T16:00:00.000Z"
+}

package/blueprints/edge-cloudflare-access/contributions/user-stories/edge-cloudflare-access-us-34105.json

@@ -0,0 +1,27 @@
+{
+  "usId": "edge-cloudflare-access-US-34105",
+  "prdId": "PRD-001",
+  "reqId": "edge-cloudflare-access-REQ-003",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Guide walks the operator through the Zero Trust dashboard AND documents the API alternative",
+  "asA": "operator applying the edge-cloudflare-access v1.0.0 blueprint",
+  "iWant": "the guide to walk me through issuing the Zero Trust policy on the Cloudflare dashboard AND to document the alternative API path",
+  "soThat": "the policy issuance flow is unambiguous whether I use the dashboard or the API",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-34105-1",
+      "description": "The shipped guide/edge-cloudflare-access.md carries a section Zero Trust dashboard walk-through with numbered steps naming each screen; and a section API alternative with a curl example against https://api.cloudflare.com/client/v4/accounts/{account_id}/access/apps/{app_id}/policies; the vendor URL https://developers.cloudflare.com/cloudflare-one/policies/access/ is cited from ADR-3501 and the guide.",
+      "given": "the shipped guide file",
+      "when": "the anatomy test greps for the two section headings, the curl example and the vendor URL",
+      "then": "each string matches at least once in the file",
+      "testable": true,
+      "scope": "library"
+    }
+  ],
+  "tacIds": [
+    "TAC-3503-edge-cloudflare-access-policy-shape"
+  ],
+  "createdAt": "2026-09-07T16:00:00.000Z",
+  "updatedAt": "2026-09-07T16:00:00.000Z"
+}

package/blueprints/edge-cloudflare-access/contributions/user-stories/edge-cloudflare-access-us-34106.json

@@ -0,0 +1,27 @@
+{
+  "usId": "edge-cloudflare-access-US-34106",
+  "prdId": "PRD-001",
+  "reqId": "edge-cloudflare-access-REQ-004",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Audit event carries only email, outcome, timestamp and path with no token value or headers",
+  "asA": "shelf consumer applying the edge-cloudflare-access v1.0.0 blueprint on a Workers project using the cf-edge fixture",
+  "iWant": "the audit sink to receive only metadata-only records for every validate-pass and validate-reject",
+  "soThat": "the audit trail is observable without leaking the JWT, its signature bytes or any request header value",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-34106-1",
+      "description": "After 5 validate-pass and 5 validate-reject requests the audit sink holds 10 records each carrying exactly {email, outcome, timestamp, path}; the serialised JSON of every record contains no substring of the JWT (header, payload or signature), no Authorization value and no header names beyond path.",
+      "given": "the shipped createAccessValidator wired with a spy audit sink and 10 requests (5 pass, 5 reject)",
+      "when": "the requests dispatch through the validator",
+      "then": "10 sink records, each with allowed keys only, none containing forbidden substrings",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-3504-edge-cloudflare-access-audit-sink"
+  ],
+  "createdAt": "2026-09-07T16:00:00.000Z",
+  "updatedAt": "2026-09-07T16:00:00.000Z"
+}

package/blueprints/edge-cloudflare-access/contributions/user-stories/edge-cloudflare-access-us-34107.json

@@ -0,0 +1,27 @@
+{
+  "usId": "edge-cloudflare-access-US-34107",
+  "prdId": "PRD-001",
+  "reqId": "edge-cloudflare-access-REQ-005",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Break-glass posture: an elicited bypass-service-auth pair authenticates CI automation",
+  "asA": "operator running CI-signed automation against an Access-gated Worker",
+  "iWant": "an elicited bypass-service-auth token pair that the validator recognises and passes through as an authenticated principal",
+  "soThat": "CI can hit the gated Worker without a browser flow while every bypass leaves a distinct audit trace",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-34107-1",
+      "description": "When the request presents the elicited service-auth id and secret (as CF-Access-Client-Id and CF-Access-Client-Secret headers), the validator observes the pair, records outcome=bypass in the audit event with the metadata-only shape, and delegates to the handler as authenticated with request.auth.email='service:'+id. Break-glass is disabled unless the elicited pair is applied.",
+      "given": "the createAccessValidator wired with an elicited bypass-service-auth pair and a request presenting the paired headers",
+      "when": "the request dispatches through the validator",
+      "then": "the handler receives request.auth with the service principal and the audit sink records outcome=bypass with allowed keys only",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-3501-edge-cloudflare-access-jwt-validator"
+  ],
+  "createdAt": "2026-09-07T16:00:00.000Z",
+  "updatedAt": "2026-09-07T16:00:00.000Z"
+}

package/blueprints/edge-cloudflare-access/contributions/user-stories/edge-cloudflare-access-us-34108.json

@@ -0,0 +1,27 @@
+{
+  "usId": "edge-cloudflare-access-US-34108",
+  "prdId": "PRD-001",
+  "reqId": "edge-cloudflare-access-REQ-006",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Admin-console composition: the sign-in surface flips per applied capability set",
+  "asA": "shelf consumer applying both edge-cloudflare-access and application-admin-console v1.1.0",
+  "iWant": "the admin-console sign-in surface to flip to Access-gated when zeroTrustGate is applied, and to fall back to the local security-auth-* surface otherwise",
+  "soThat": "the composition is deterministic and no local login form leaks into an Access-gated deployment",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-34108-1",
+      "description": "Two applied combinations are exercised on the extended admin-console fixture: with ?caps=principalDirectory,roleModel,auditLog,zeroTrustGate the sign-in surface renders [data-surface=access-gated] and no [data-surface=local-login] is present; with ?caps=principalDirectory,roleModel,auditLog the sign-in surface renders [data-surface=local-login] and no [data-surface=access-gated] is present. Both combinations exercise the shipped pack check AC-21815-1 on application-admin-console.pack.mjs (pack check fires only on the gated combination).",
+      "given": "the extended admin-console pack fixture with the two caps combinations",
+      "when": "the pack runs against each combination",
+      "then": "AC-21815-1 fires on the gated combination and passes; the existing v1.0.0 surface renders on the non-gated combination and its own checks pass",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-3502-edge-cloudflare-access-application-declaration"
+  ],
+  "createdAt": "2026-09-07T16:00:00.000Z",
+  "updatedAt": "2026-09-07T16:00:00.000Z"
+}

package/blueprints/edge-cloudflare-access/contributions/user-stories/edge-cloudflare-access-us-34109.json

@@ -0,0 +1,27 @@
+{
+  "usId": "edge-cloudflare-access-US-34109",
+  "prdId": "PRD-001",
+  "reqId": "edge-cloudflare-access-REQ-006",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Real-account gated URL round-trip against a scheduled Access-configured hostname",
+  "asA": "HQ operator running the real-account gated-URL smoke against a scheduled Access-configured hostname",
+  "iWant": "the probe to fire against the hostname when the env vars are present and record accountBoundSkipped when not",
+  "soThat": "the mechanism-reach claim is proven on a real Cloudflare Access instance without ever failing the shelf gate on the absence of an account",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-34109-1",
+      "description": "With CI_HAS_CLOUDFLARE_ACCOUNT=true and CF_ACCESS_HOST=<hostname>, a plain fetch against https://<hostname>/ follows the redirect chain and terminates at an https://<team>.cloudflareaccess.com/ URL (the Access UI). Without either env var the probe records accountBoundSkipped=true and aggregateVerdict=pass per spec section 3.5.",
+      "given": "the run-real-account-gated-url.mjs probe shim and the two env vars",
+      "when": "the probe runs",
+      "then": "in the CI-with-account path the redirect chain reports cloudflareaccess.com as terminal; in the without-env path accountBoundSkipped is true",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-3502-edge-cloudflare-access-application-declaration"
+  ],
+  "createdAt": "2026-09-07T16:00:00.000Z",
+  "updatedAt": "2026-09-07T16:00:00.000Z"
+}

package/blueprints/edge-cloudflare-access/docs/topics.md

@@ -0,0 +1,68 @@
+# edge-cloudflare-access blueprint coordination vocabulary
+
+This file is the edge-cloudflare-access half of the cross-blueprint contract. The Phase 1 conflict detector matches scope:global ADR topics by EXACT string equality, and AC ids are unnamespaced by the 0.4.4 grammar. Any blueprint intended to compose with this one must reuse these exact strings and respect these bands.
+
+## Global ADR topics this blueprint contributes (exact strings)
+
+| Topic string | edge-cloudflare-access contribution | Origin | Composition note |
+|---|---|---|---|
+| `edgeAuthenticationGate` | ADR-3501-edge-cloudflare-access-jwt-gate | Minted by this blueprint. Names the wire-shape contract for the project-wide edge authentication gate; the shipped answer is a Cloudflare Access Zero-Trust JWT-assertion gate per https://developers.cloudflare.com/cloudflare-one/policies/access/. | The one project-wide decision on the edge authentication gate at the shipped-shape boundary. A future non-Cloudflare sibling (Google Cloud IAP, AWS Verified Access, Duo Beyond) would contribute the same topic string with a different answer, forcing a DELIBERATE conflict the operator resolves with a project-level ADR. |
+
+The edge-cloudflare-access blueprint claims one global topic (minted here, shipped as the Cloudflare Access JWT-assertion gate). ADR-3502 identity provider, ADR-3503 policy scope and ADR-3504 audit retention do not contribute global topics; a composing blueprint that holds an opinion on any of them authors its own project-level ADR.
+
+Rules for new topics: lower camel case, one concept per topic, no version suffixes. A topic names the decision area, not the chosen answer.
+
+## Id number bands (registry bootstrap)
+
+This table is maintained shelf-wide across every blueprint's `docs/topics.md`. Rows are recorded at ship, never predicted.
+
+| Blueprint | US band | ADR/TAC suffix block | Status | Global topics |
+|---|---|---|---|---|
+| application-spa | 1101-1899 | 2xx | shipped v1.3.0 | `clientRouting`, `theming`, `clientState`, `errorEnvelope`, `authModel` |
+| application-api-rest | 2101-2899 | 3xx | shipped v1.0.0 | `errorEnvelope`, `authModel`, `apiVersioning`, `logging` |
+| security-auth-magic-link | 3101-3899 | 5xx | shipped v1.0.0 | `authModel` |
+| email-smtp-resend | 4101-4899 | 4xx | shipped v1.0.0 | none |
+| hello-panel (walkthrough exemplar) | 4101-4899 | 4xx | doc-reserved; teaching exemplar in `packages/rcf-lite/docs/blueprint-authoring-walkthrough.md`, not shipped as a blueprint directory | `operatorPanel` |
+| persistence-data-sqlite | 5101-5899 | 6xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
+| delivery-ci-workflows | 6101-6899 | 7xx | shipped v2.0.0 (renamed from ci-pipeline) | `ciGates`, `strictCoverageGate`, `releaseArtefacts` |
+| observability-essentials | 7101-7899 | 8xx | shipped v2.0.0 | `statusPageContract` |
+| security-secrets-management | 8101-8899 | 9xx | shipped v1.0.1 | `secretsSource` |
+| security-auth-clerk | 9101-9899 | 10xx | shipped v1.0.0 | `authModel` |
+| security-auth-oauth2 | 10101-10899 | 11xx | shipped v1.0.0 | `authModel` |
+| security-auth-keycloak | 11101-11899 | 12xx | shipped v1.0.0 | `authModel` |
+| deploy-cloudflare-workers | 12101-12899 | 13xx | shipped v1.2.0 | `deploymentTarget` |
+| persistence-data-d1 | 13101-13899 | 14xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
+| observability-probe-endpoints | 14101-14899 | 15xx | shipped v1.1.0 | `healthProbes`, `readinessSemantics` |
+| observability-logging | 15101-15899 | 16xx | shipped v1.0.0 | `logging` |
+| application-error-handling | 16101-16899 | 17xx | shipped v1.0.0 | `errorHandling` |
+| application-datatable | 17101-17899 | 18xx | shipped v1.0.0 | none |
+| application-charts | 18101-18899 | 19xx | shipped v1.0.0 | none |
+| application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
+| application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
+| application-admin-console | 21101-21899 | 22xx | shipped v1.1.0 | `adminConsoleSignInSurface` |
+| application-empty-error-states | 22101-22899 | 23xx | shipped v1.0.0 | none |
+| application-file-upload | 23101-23899 | 24xx | shipped v1.0.0 | none |
+| application-forms-wizard | 24101-24899 | 25xx | shipped v1.0.0 | none |
+| application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
+| application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
+| persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
+| jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
+| platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |
+| platform-cloudflare-cron-triggers | 32101-32899 | 33xx | shipped v1.0.0 | `scheduledTriggerContract` |
+| platform-cloudflare-durable-objects | 33101-33899 | 34xx | shipped v1.0.0 | `strongConsistencyCellContract`, `websocketHubContract` |
+| edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
+| edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
+| edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
+
+US 34101-34109 sit at the LOW end of the 34101-34899 band on purpose (watchpost run-4 lesson). ADR/TAC suffixes for this blueprint use the 3501-3599 block, continuing the shelf pattern.
+
+## Shared expectations for future composing blueprints
+
+- Reuse `edgeAuthenticationGate` exactly as spelled here when your blueprint holds an opinion on the edge authentication gate contract; contribute your own scope:global ADR on that string and let composition surface the pairing.
+- Consumer blueprints reading the `zeroTrustGate` capability declared on `blueprint.json` per section 6a of `blueprint-authoring.md` obtain the Access-gated composition at apply time via the T-5 visual-round capability-declaration mechanism.
+
+## Deliberate-conflict statement
+
+This blueprint's ADR-3501 on `edgeAuthenticationGate` is the first shipped answer to a topic that will conflict, by design, with future non-Cloudflare siblings. Applying `edge-cloudflare-access` alongside such a sibling would raise a `globalAdrTopic` conflict the operator resolves via one of the four documented resolutions (adopt one, keep the existing one, author a project-level supersede ADR, or `--resolve <topic>=project:<ADR-id>` on the add).