rcf-lite 0.23.0 → 0.24.0

package/blueprints/edge-cloudflare-access/guide/edge-cloudflare-access.md

@@ -0,0 +1,180 @@
+# edge-cloudflare-access guide
+
+## When to reach for this blueprint
+
+You reach for `edge-cloudflare-access` when your Workers project
+needs an authenticated edge (only authenticated principals reach
+the origin Worker), when you have adopted the Zero Trust posture,
+and when you want a vendor-neutral seam (`request.auth`) between
+Cloudflare's Access edge and your downstream handlers.
+
+If you are shipping a fully-public Worker (no authentication at all),
+this blueprint is not for you. If you are running a security-auth-*
+blueprint inside the Worker (in-app authentication), you probably
+also want Cloudflare Access as a second layer to keep unauthenticated
+traffic off the origin; the composition is straightforward.
+
+## Composition with application-admin-console
+
+Applying `application-admin-console` v1.1.0 alongside this blueprint
+flips the admin-console sign-in surface (`/admin/sign-in`):
+
+- With `zeroTrustGate` in the applied capability set (this
+  blueprint declares it): the sign-in page renders
+  `[data-surface=access-gated]` with no local form.
+- Without `zeroTrustGate` (this blueprint not applied): the
+  sign-in page renders `[data-surface=local-login]` with the local
+  `security-auth-*` form unchanged from v1.0.0.
+
+The Q4 default (spec section 5.4.1) is: consumption is OPTIONAL.
+The v1.1.0 admin-console remains backward-compatible with every
+v1.0.0 deployment.
+
+## Elicited parameters at apply
+
+- `access-application-host` OR `access-selfhosted-app-id`: pick
+  exactly one. The dashboard walk-through follows the hostname
+  path when the first is set and the self-hosted-app id path
+  when the second is set.
+- `access-audience`: the JWT audience tag the Access policy issues.
+  Every JWT the validator accepts must carry this string as its
+  `aud` claim.
+- `access-jwks-url`: the JWKS endpoint URL the validator fetches.
+  Cloudflare Access publishes this at
+  `https://<team>.cloudflareaccess.com/cdn-cgi/access/certs`.
+- `access-policy-shape` (default `email-domain`): one of the four
+  values in the enum below.
+- `access-bypass-service-auth-id`: leave blank to disable
+  break-glass. When set, the paired secret is delegated to the
+  applied `secretsManagement` companion.
+
+## Policy shape enum
+
+| Shape | What it allows | Suited to |
+| --- | --- | --- |
+| `email-domain` | Any principal whose email ends `@<domain>` on the Access-managed identity provider. | Solo, small team, workspace-wide access on a company domain. |
+| `service-token-only` | Only the elicited bypass-service-auth pair; no browser principals. | CI-only endpoints (webhooks, ingest APIs). |
+| `service-token-plus-email-domain` | Either the paired service-auth or an on-domain email principal. | Endpoints reached by CI AND humans. |
+| `group-membership` | Only principals whose identity-provider group claim contains an elicited group name (Okta, Entra ID, Google Groups). | Enterprise SSO with role-based access. |
+
+The Cloudflare edge enforces the shape before a request reaches
+the origin Worker; the shipped validator receives the JWT the
+Access edge signs and verifies the audience, the expiry and the
+signature.
+
+## Zero Trust dashboard walk-through
+
+Screen-by-screen path for a fresh Cloudflare account. Vendor URL:
+`https://developers.cloudflare.com/cloudflare-one/policies/access/`.
+
+1. Sign in to `dash.cloudflare.com` and select your account.
+2. In the left nav, open `Zero Trust`. If the dashboard prompts
+   you to create a team, do so with the elicited team name (the
+   `<team>` in `https://<team>.cloudflareaccess.com/`).
+3. In the Zero Trust dashboard, open `Access` -> `Applications`,
+   then `Add an application`.
+4. Pick `Self-hosted` (both for hostname-scoped applications and
+   for self-hosted-app id-based applications).
+5. Enter the application name (`admin.example.com` for the
+   hostname path or the app id string for the self-hosted-app id
+   path), the session duration (default 24h is fine for an
+   internal console) and the application domain (the hostname
+   the Worker binds to).
+6. On the `Add policies` screen, `Add a policy`.
+7. On the policy screen, pick the `Action` (`Allow` for the
+   principal set the shape names above), then add one `Include`
+   selector matching the shape:
+   - `email-domain`: `Include -> Email ending in` -> your domain.
+   - `service-token-only`: `Include -> Service Auth Token` -> the
+     token generated in `Zero Trust` -> `Access` -> `Service Auth`.
+   - `service-token-plus-email-domain`: add both selectors.
+   - `group-membership`: `Include -> IdP Group name` -> the group
+     the elicited identity-provider claims.
+8. Save the policy, save the application. The dashboard prints
+   the `Application audience tag` at the top of the application
+   card; copy it verbatim into the `access-audience` elicit
+   answer on apply.
+9. Confirm the JWKS endpoint at
+   `https://<team>.cloudflareaccess.com/cdn-cgi/access/certs`
+   returns a valid JWKS document; copy the URL into the
+   `access-jwks-url` elicit answer.
+
+The blueprint is now ready to apply on the Worker project.
+
+## API alternative
+
+If you prefer to script the policy issuance rather than click
+through the dashboard, use the Cloudflare API. Vendor URL:
+`https://developers.cloudflare.com/cloudflare-one/policies/access/`.
+
+```
+curl -X POST \
+  https://api.cloudflare.com/client/v4/accounts/{account_id}/access/apps/{app_id}/policies \
+  -H "Authorization: Bearer $CF_API_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{
+    "name": "Access policy for admin.example.com",
+    "decision": "allow",
+    "include": [
+      { "email_domain": { "domain": "example.com" } }
+    ],
+    "session_duration": "24h"
+  }'
+```
+
+Replace the `include` block with the shape you picked from the
+enum. The `app_id` is the value the dashboard printed when the
+application was created; the `account_id` is the standard
+Cloudflare account id from your account settings. The endpoint is
+idempotent when the policy name matches an existing policy per
+Cloudflare's documented semantics.
+
+## Break-glass posture
+
+Set `access-bypass-service-auth-id` at apply to enable break-glass.
+The paired secret is delegated to the applied `secretsManagement`
+companion via `security-secrets-management`; the CI runner then
+supplies both values as `CF-Access-Client-Id` and
+`CF-Access-Client-Secret` headers on every request that would
+otherwise fail Access at the browser boundary. The validator
+observes the pair, records `outcome: bypass` on the audit sink
+with the metadata-only shape, and delegates to the handler with
+`request.auth.email = 'service:'+id`.
+
+The break-glass code path is disabled unless an elicited pair is
+applied; a request presenting the paired headers when no pair is
+elicited is rejected as `missing` (fall through to the JWT path).
+
+## Composed apply-line
+
+One project, admin-console v1.1.0 plus edge-cloudflare-access
+v1.0.0, `email-domain` policy shape:
+
+```
+rcf define blueprint add application-admin-console --version 1.1.0
+rcf define blueprint add edge-cloudflare-access --version 1.0.0 \
+  --answer access-application-host=admin.example.com \
+  --answer access-audience=<audience-copied-from-dashboard> \
+  --answer access-jwks-url=https://<team>.cloudflareaccess.com/cdn-cgi/access/certs \
+  --answer access-policy-shape=email-domain
+```
+
+The admin-console applies first (its `principalDirectory`
+requirement is met by whatever `security-auth-*` you have
+applied). The Access blueprint applies second, records
+`zeroTrustGate` on `rcf/blueprints/edge-cloudflare-access.applied.json`,
+and the admin-console's next surface render picks the Access-gated
+branch on `/admin/sign-in`.
+
+## Standards trace
+
+- `ADR-3501-edge-cloudflare-access-jwt-gate` carries
+  `standardsTraceClause: Cloudflare Access policy actions and rule
+  selectors` per
+  https://developers.cloudflare.com/cloudflare-one/policies/access/.
+- `ADR-3503-edge-cloudflare-access-policy-scope` carries the same
+  clause.
+- `ADR-3502-edge-cloudflare-access-identity-provider` and
+  `ADR-3504-edge-cloudflare-access-audit-retention` carry the
+  sentinel `generic enterprise practice` (no vendor documentation
+  constrains identity provider or audit retention).

package/blueprints/edge-cloudflare-rate-limiting/CHANGELOG.md

@@ -0,0 +1,10 @@
+# edge-cloudflare-rate-limiting changelog
+
+## 1.0.0 (round 6 T-6, 2026-09-07)
+
+- First shipped version. Zone-level rate limiting as an edge gate in front of Worker handlers per the ratified `cloudflare-round-6-spec-2026-09-06.md` section 5.6.
+- Five REQs, eight USs, three TACs, four ADRs. Twenty contributions total.
+- Ships the local rate-limit rules manifest schema (draft-07), the operator-facing management surface guide with both wrangler and dashboard flows, the drift-audit runner realisation on the `cf-edge` fixture and the composition ADR with `security-auth-magic-link`.
+- Mints capability `edgeRateLimit` and global topic `edgeThrottleContract` (ADR-3701, scope global).
+- Four Node-only probes: `manifest-presence`, `manifest-schema-validate`, `event-secrecy`, `real-account-burst-and-429`. The last carries `accountBound: true` and records `accountBoundSkipped: true` in CI without `CI_HAS_CLOUDFLARE_ACCOUNT` per spec section 3.5 and ruling 6.
+- `cf-edge` fixture extended additively: `cloudflare/rate-limits/example.json`, `cloudflare/rate-limits/api-writes.json`, `src/drift-audit-runner.mjs`, three induced-failure switches (`SIMULATE_MANIFEST_MISSING`, `SIMULATE_SCHEMA_INVALID`, `SIMULATE_EVENT_LEAK_IP`).

package/blueprints/edge-cloudflare-rate-limiting/README.md

@@ -0,0 +1,73 @@
+# edge-cloudflare-rate-limiting
+
+Zone-level rate limiting as an edge gate in front of Worker handlers, configured through a local manifest the applying project commits and applies to the live Cloudflare zone via a documented wrangler or dashboard flow. Ships v1.0.0 of the round-6 T-6 track per `projects/blueprint-library/specs/cloudflare-round-6-spec-2026-09-06.md` section 5.6.
+
+- **Category:** `edge`.
+- **Capability provided:** `edgeRateLimit`.
+- **Global topic minted:** `edgeThrottleContract` (ADR-3701, scope global).
+- **Suggested companions:** `logging`, `errorHandling`, `secretsManagement`.
+
+## The five REQs
+
+| Id | What it commits |
+| --- | --- |
+| REQ-001 | Local rules manifest: one JSON file per rule under the elicited `rate-limit-rules-dir` (default `cloudflare/rate-limits/`) carries the seven documented fields. |
+| REQ-002 | Operator-facing management surface: a documented wrangler or Cloudflare-dashboard flow the operator runs to apply the manifest to the live zone. No committed script. |
+| REQ-003 | Over-threshold behaviour: over the rule limit within the period, the (N+1)th and subsequent requests within the elicited duration return 429 with `Retry-After` and `Cf-Ray`; the origin never sees them. |
+| REQ-004 | Drift audit: an opt-in scheduled runner reads live zone rules via the Cloudflare API and diffs against the local manifest, constructing metadata-only records per REQ-005 event-secrecy. |
+| REQ-005 | Composition with `security-auth-magic-link`: the zone rule sits OVER the per-email application rule per ADR-3702 layering. |
+
+## Elicited parameters
+
+- `rate-limit-rules-dir` (default `cloudflare/rate-limits`): where the applying project commits manifest files.
+- `rate-limit-zone-id` (default empty): the Cloudflare zone id the rules apply to. Never inlined in a manifest file; stored via the applied `secretsManagement` companion.
+- `rate-limit-management-surface` (default `both`): `wrangler`, `dashboard`, or `both`. Records the operator's flow choice; the guide walks both.
+- `rate-limit-drift-audit-cadence` (default `daily`): `off`, `daily`, `hourly`. Per ADR-3704.
+
+## Manifest shape (TAC-3701)
+
+The shipped JSON Schema at `contributions/schemas/rate-limit-rule.schema.json` (draft-07) names the seven required fields per `https://developers.cloudflare.com/waf/rate-limiting-rules/`:
+
+| Field | Type | Meaning |
+| --- | --- | --- |
+| `id` | string | Stable operator-facing rule id (kebab-case). Used as `ruleId` in drift-audit records. |
+| `expression` | string | Cloudflare WAF rules-language expression scoping the rule. |
+| `threshold` | integer >=1 | Requests permitted per period on the characteristic set. |
+| `period` | integer >=1 | Window in seconds the threshold applies over. |
+| `characteristics` | string[] (non-empty) | Characteristic strings the rule keys on (e.g. `ip.src`, `cf.colo.id`). |
+| `action` | enum | `block`, `challenge`, `log`, `managed_challenge`. |
+| `duration` | integer >=1 | Block window in seconds the (N+1)th and subsequent requests are refused for. |
+
+`additionalProperties: false`; a `description` field is optional.
+
+## Probes
+
+Four Node-only probes under `contributions/probes/`; three run in CI, one is account-bound and skips per ruling 6.
+
+| Probe | Anchor AC | `accountBound` | What it drives |
+| --- | --- | --- | --- |
+| `manifest-presence.mjs` | AC-36101-1 (also AC-36108-1 under `SIMULATE_MANIFEST_MISSING=true`) | false | Reads `cf-edge/cloudflare/rate-limits/`, asserts every file parses, carries the seven required fields and holds no plaintext secret. |
+| `manifest-schema-validate.mjs` | AC-36106-1 | false | Validates every manifest file against the shipped JSON Schema. Under `SIMULATE_SCHEMA_INVALID=true` writes a scratch file missing `threshold` and fails. |
+| `event-secrecy.mjs` | AC-36107-1 | false | Drives the shipped drift-audit runner realisation with a synthetic manifest and a fake fetch; asserts every drift record carries only `{ruleId, clientIpHash, outcome, timestamp, diff}`. Under `SIMULATE_EVENT_LEAK_IP=true` the runner injects a full IP and the probe fails. |
+| `real-account-burst-and-429.mjs` | AC-36103-1 | true | Fires an in-process burst against `CF_RATE_LIMIT_URL` under `CI_HAS_CLOUDFLARE_ACCOUNT=true` and asserts the (N+1)th and subsequent responses return 429 with `Retry-After` and `Cf-Ray`. Without either env var records `accountBoundSkipped: true` and aggregates to `pass` per spec section 3.5 and ruling 6. |
+
+### Ruling 6 restated
+
+Spec section 1, verbatim: "If the rate-limiting real-account burst probe is not CI-feasible, ship with the local manifest AC and mark the burst check account-bound skipped." Without `CI_HAS_CLOUDFLARE_ACCOUNT` the CI verdict for `real-account-burst-and-429` is `accountBoundSkipped: true` and this IS the accepted verdict; the aggregate flips to `pass`. The local manifest ACs (AC-36101-1, AC-36106-1, AC-36107-1) always run and always gate the ship.
+
+## Composition with `security-auth-magic-link` (ADR-3702)
+
+When both blueprints apply, the zone-level rate rule (characteristic set: IP-per-URL) sits at the CF edge and refuses the (N+1)th request for the elicited duration before it reaches the origin; the `security-auth-magic-link` per-email application rate limiter (characteristic set: per-email per-minute) continues to run on requests that pass the edge gate at the mint-surface. The two rules operate on different characteristic sets and are additive, not overlapping. See the guide for a copy-paste example.
+
+## Standards trace
+
+- ADR-3701: `Cloudflare WAF rate-limiting rules documented shape` (`https://developers.cloudflare.com/waf/rate-limiting-rules/`).
+- ADR-3702, ADR-3703, ADR-3704: `generic enterprise practice`.
+
+## Vendor citations
+
+- Cloudflare WAF rate-limiting rules: `https://developers.cloudflare.com/waf/rate-limiting-rules/` (documents `expression`, `threshold`, `period`, `characteristics`, `action`, `duration`; fetched 200 on 2026-09-07 for the round-6 T-6 ship).
+
+## Known mechanism-reach gaps
+
+- The over-threshold observable (AC-36103-1) is only proven at the runtime seam with a real Cloudflare account. In CI without `CI_HAS_CLOUDFLARE_ACCOUNT` the probe records `accountBoundSkipped: true` per ruling 6; the local manifest and event-secrecy ACs cover source-observable correctness.

package/blueprints/edge-cloudflare-rate-limiting/blueprint.json

@@ -0,0 +1,174 @@
+{
+  "slug": "edge-cloudflare-rate-limiting",
+  "version": "1.0.0",
+  "category": "edge",
+  "capabilities": [
+    "edgeRateLimit"
+  ],
+  "suggestedCompanions": [
+    {
+      "role": "logging",
+      "reason": "Every drift-audit report and every rate-limit event writes through the applied logger; a logging companion supplies the sink factory."
+    },
+    {
+      "role": "errorHandling",
+      "reason": "A drift-audit failure, a Cloudflare API error, a manifest schema violation constructs an internal error record; an error-handling companion supplies the record factory and the boundary."
+    },
+    {
+      "role": "secretsManagement",
+      "reason": "The Cloudflare API token that the drift-audit runner and any wrangler-based apply flow use is stored via the applied secretsManagement companion; the elicited zone id may also be projected through the vault when the operator wants a single source of truth."
+    }
+  ],
+  "elicits": [
+    {
+      "id": "rate-limit-rules-dir",
+      "prompt": "Directory the applying project commits its rate-limit rule manifest files into. One file per rule per ADR-3703. The manifest is source-of-truth; the operator applies it via wrangler or the Cloudflare dashboard per REQ-002.",
+      "kind": "string",
+      "default": "cloudflare/rate-limits"
+    },
+    {
+      "id": "rate-limit-zone-id",
+      "prompt": "Cloudflare zone id the rules apply to. Never inline in a rule manifest; store via the applied secretsManagement companion and reference at apply time. Empty string leaves the zone id unresolved (the drift audit and any wrangler flow surface the omission).",
+      "kind": "string",
+      "default": ""
+    },
+    {
+      "id": "rate-limit-management-surface",
+      "prompt": "Operator-facing management surface per REQ-002 and TAC-3702. wrangler names the command flow the guide walks through; dashboard names the Cloudflare dashboard flow; both records both flows and lets the operator pick per rule.",
+      "kind": "enum",
+      "options": [
+        "wrangler",
+        "dashboard",
+        "both"
+      ],
+      "default": "both"
+    },
+    {
+      "id": "rate-limit-drift-audit-cadence",
+      "prompt": "Drift-audit cadence per ADR-3704. off disables the runner; daily runs it every 24 hours; hourly runs it every hour. daily is the recommended default.",
+      "kind": "enum",
+      "options": [
+        "off",
+        "daily",
+        "hourly"
+      ],
+      "default": "daily"
+    }
+  ],
+  "contributions": [
+    {
+      "id": "edge-cloudflare-rate-limiting-REQ-001",
+      "kind": "req",
+      "path": "requirements/edge-cloudflare-rate-limiting-req-001.json"
+    },
+    {
+      "id": "edge-cloudflare-rate-limiting-REQ-002",
+      "kind": "req",
+      "path": "requirements/edge-cloudflare-rate-limiting-req-002.json"
+    },
+    {
+      "id": "edge-cloudflare-rate-limiting-REQ-003",
+      "kind": "req",
+      "path": "requirements/edge-cloudflare-rate-limiting-req-003.json"
+    },
+    {
+      "id": "edge-cloudflare-rate-limiting-REQ-004",
+      "kind": "req",
+      "path": "requirements/edge-cloudflare-rate-limiting-req-004.json"
+    },
+    {
+      "id": "edge-cloudflare-rate-limiting-REQ-005",
+      "kind": "req",
+      "path": "requirements/edge-cloudflare-rate-limiting-req-005.json"
+    },
+    {
+      "id": "edge-cloudflare-rate-limiting-US-36101",
+      "kind": "us",
+      "path": "user-stories/edge-cloudflare-rate-limiting-us-36101.json"
+    },
+    {
+      "id": "edge-cloudflare-rate-limiting-US-36102",
+      "kind": "us",
+      "path": "user-stories/edge-cloudflare-rate-limiting-us-36102.json"
+    },
+    {
+      "id": "edge-cloudflare-rate-limiting-US-36103",
+      "kind": "us",
+      "path": "user-stories/edge-cloudflare-rate-limiting-us-36103.json"
+    },
+    {
+      "id": "edge-cloudflare-rate-limiting-US-36104",
+      "kind": "us",
+      "path": "user-stories/edge-cloudflare-rate-limiting-us-36104.json"
+    },
+    {
+      "id": "edge-cloudflare-rate-limiting-US-36105",
+      "kind": "us",
+      "path": "user-stories/edge-cloudflare-rate-limiting-us-36105.json"
+    },
+    {
+      "id": "edge-cloudflare-rate-limiting-US-36106",
+      "kind": "us",
+      "path": "user-stories/edge-cloudflare-rate-limiting-us-36106.json"
+    },
+    {
+      "id": "edge-cloudflare-rate-limiting-US-36107",
+      "kind": "us",
+      "path": "user-stories/edge-cloudflare-rate-limiting-us-36107.json"
+    },
+    {
+      "id": "edge-cloudflare-rate-limiting-US-36108",
+      "kind": "us",
+      "path": "user-stories/edge-cloudflare-rate-limiting-us-36108.json"
+    },
+    {
+      "id": "TAC-3701-edge-cloudflare-rate-limiting-manifest-schema",
+      "kind": "tac",
+      "path": "tacs/tac-3701-edge-cloudflare-rate-limiting-manifest-schema.json"
+    },
+    {
+      "id": "TAC-3702-edge-cloudflare-rate-limiting-management-surface-doc",
+      "kind": "tac",
+      "path": "tacs/tac-3702-edge-cloudflare-rate-limiting-management-surface-doc.json"
+    },
+    {
+      "id": "TAC-3703-edge-cloudflare-rate-limiting-drift-audit-runner",
+      "kind": "tac",
+      "path": "tacs/tac-3703-edge-cloudflare-rate-limiting-drift-audit-runner.json"
+    },
+    {
+      "id": "ADR-3701-edge-cloudflare-rate-limiting-throttle-contract",
+      "kind": "adr",
+      "path": "adrs/adr-3701-edge-cloudflare-rate-limiting-throttle-contract.json",
+      "scope": "global",
+      "topic": "edgeThrottleContract",
+      "recommendedDefault": true,
+      "elicited": false,
+      "standardsTraceClause": "Cloudflare WAF rate-limiting rules documented shape"
+    },
+    {
+      "id": "ADR-3702-edge-cloudflare-rate-limiting-layering",
+      "kind": "adr",
+      "path": "adrs/adr-3702-edge-cloudflare-rate-limiting-layering.json",
+      "recommendedDefault": true,
+      "elicited": false,
+      "standardsTraceClause": "generic enterprise practice"
+    },
+    {
+      "id": "ADR-3703-edge-cloudflare-rate-limiting-manifest-shape",
+      "kind": "adr",
+      "path": "adrs/adr-3703-edge-cloudflare-rate-limiting-manifest-shape.json",
+      "recommendedDefault": true,
+      "elicited": false,
+      "standardsTraceClause": "generic enterprise practice"
+    },
+    {
+      "id": "ADR-3704-edge-cloudflare-rate-limiting-drift-audit-cadence",
+      "kind": "adr",
+      "path": "adrs/adr-3704-edge-cloudflare-rate-limiting-drift-audit-cadence.json",
+      "recommendedDefault": true,
+      "elicited": true,
+      "standardsTraceClause": "generic enterprise practice"
+    }
+  ]
+}

package/blueprints/edge-cloudflare-rate-limiting/contributions/adrs/adr-3701-edge-cloudflare-rate-limiting-throttle-contract.json

@@ -0,0 +1,14 @@
+{
+  "adrId": "ADR-3701-edge-cloudflare-rate-limiting-throttle-contract",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "accepted",
+  "title": "Edge throttle contract: Cloudflare WAF rate-limiting rules as the shipped shape (scope global, new topic edgeThrottleContract)",
+  "context": "An applying Workers project that fronts a public surface needs a zone-level guard that refuses over-threshold bursts at the CF edge before they reach the origin Worker. Cloudflare's WAF rate-limiting rules provide the native answer: a set of rules on the zone, each with expression, threshold, period, characteristics, action and duration per https://developers.cloudflare.com/waf/rate-limiting-rules/. Every applied Worker needs one project-wide answer to the edgeThrottleContract topic; a future non-Cloudflare edge-throttle sibling (Fastly rate-limits, Vercel edge config throttles) would conflict on the same topic by design.",
+  "decision": "The shipped v1.0.0 default is Cloudflare WAF rate-limiting rules as the zone-level edge throttle. The rule shape (id, expression, threshold, period, characteristics, action, duration) matches the Cloudflare-documented shape per https://developers.cloudflare.com/waf/rate-limiting-rules/. The edgeThrottleContract topic scope is global on this blueprint; the topic string is edgeThrottleContract (lower camel case, one concept per topic, no version suffix). A future non-Cloudflare adapter contributes the same topic string with a different answer, forcing a DELIBERATE conflict the operator resolves with a project-level ADR. Standards trace clause: Cloudflare WAF rate-limiting rules documented shape.",
+  "consequences": "The applying project inherits Cloudflare's documented rule shape and the platform-imposed limits on rules per zone. The rule state lives on the Cloudflare account, not in the project git tree; the local manifest under cloudflare/rate-limits/ is the source of truth an operator applies via the wrangler or dashboard flow per REQ-002. Drift risk is addressed via ADR-3704 (drift-audit cadence) and TAC-3703 (drift-audit runner). Consumers deploying to a non-Cloudflare edge reach for a sibling adapter blueprint that would land as a v1.x minor on this shelf.",
+  "alternativesConsidered": [],
+  "createdAt": "2026-09-07T22:00:00.000Z",
+  "updatedAt": "2026-09-07T22:00:00.000Z"
+}

package/blueprints/edge-cloudflare-rate-limiting/contributions/adrs/adr-3702-edge-cloudflare-rate-limiting-layering.json

@@ -0,0 +1,14 @@
+{
+  "adrId": "ADR-3702-edge-cloudflare-rate-limiting-layering",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "accepted",
+  "title": "Layering with security-auth-magic-link: zone rate rule sits OVER the per-email application rule",
+  "context": "The security-auth-magic-link blueprint ships a per-email per-minute application-level rate limiter on the mint surface. The edge-cloudflare-rate-limiting blueprint ships a zone-level rate rule characterised by IP-per-URL at the CF edge. Applying both blueprints without an explicit layering ADR would leave two rate rules whose characteristic sets an operator could easily mistake for overlapping.",
+  "decision": "When both blueprints are applied, the zone-level rate rule sits at the CF edge and refuses the (N+1)th request for the elicited duration before it reaches the origin Worker; the security-auth-magic-link per-email application limiter continues to run on requests that pass the edge gate, applying per-email per-minute limits at the mint-surface. The two rules operate on different characteristic sets (IP-per-URL at the zone, email at the application) and are additive, not overlapping. recommendedDefault: true. Standards trace clause: generic enterprise practice.",
+  "consequences": "The composition is documented in the blueprint guide with a copy-paste example (AC-36105-1). The applied recorder records both blueprints so the operator sees the two-rule shape at apply time; a subsequent change to either rule's characteristic that would drift the composition into overlap is caught in the drift-audit runner (TAC-3703).",
+  "alternativesConsidered": [],
+  "createdAt": "2026-09-07T22:00:00.000Z",
+  "updatedAt": "2026-09-07T22:00:00.000Z"
+}

package/blueprints/edge-cloudflare-rate-limiting/contributions/adrs/adr-3703-edge-cloudflare-rate-limiting-manifest-shape.json

@@ -0,0 +1,14 @@
+{
+  "adrId": "ADR-3703-edge-cloudflare-rate-limiting-manifest-shape",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "accepted",
+  "title": "Manifest lives at cloudflare/rate-limits/, one JSON file per rule; the operator applies via wrangler or dashboard, not via a committed script",
+  "context": "The rule set could be committed as a wrangler-shape script, a bespoke apply tool, a single manifest file, or one file per rule. The single-file shape hides diff signal when one rule changes; the committed script couples the source of truth to a specific tool. The one-file-per-rule shape keeps a rule change to one file diff, makes review straightforward, and leaves the apply flow to the operator's choice of wrangler or dashboard.",
+  "decision": "The manifest lives at the elicited rate-limit-rules-dir (default cloudflare/rate-limits/), with one JSON file per rule. The blueprint ships no committed script that writes rules to the live zone; the operator applies through the documented wrangler or dashboard flow per REQ-002 and TAC-3702. recommendedDefault: true. Standards trace clause: generic enterprise practice.",
+  "consequences": "One-file-per-rule keeps each rule diff scoped; the operator can review a rule change in isolation. No committed apply script means the shipped blueprint does not couple to a specific tool version and does not require a Cloudflare API token at build time. Operator applies the manifest at a cadence they set; drift risk is addressed via ADR-3704 and TAC-3703.",
+  "alternativesConsidered": [],
+  "createdAt": "2026-09-07T22:00:00.000Z",
+  "updatedAt": "2026-09-07T22:00:00.000Z"
+}

package/blueprints/edge-cloudflare-rate-limiting/contributions/adrs/adr-3704-edge-cloudflare-rate-limiting-drift-audit-cadence.json

@@ -0,0 +1,14 @@
+{
+  "adrId": "ADR-3704-edge-cloudflare-rate-limiting-drift-audit-cadence",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "accepted",
+  "title": "Drift-audit cadence: off, daily or hourly (elicited; recommendedDefault daily)",
+  "context": "Rate-limit rules live on the Cloudflare account, not in the project git tree. An operator that changes a rule on the dashboard without a matching manifest update leaves the source of truth behind; a manifest edit that is not applied to the live zone leaves the live behaviour behind. Both directions of drift are runtime-observable but only if the applying project runs the drift-audit runner at a cadence.",
+  "decision": "The drift-audit cadence is elicited (rate-limit-drift-audit-cadence) with three options: off (disables the runner), daily (24-hour cadence), hourly (60-minute cadence). recommendedDefault: daily. elicited: true. Standards trace clause: generic enterprise practice.",
+  "consequences": "daily is the safe default for the typical operator (a manifest change that misses the live zone is surfaced within 24 hours through the applied logging companion's audit sink). hourly is the safe default for a high-cadence operation (the applying project makes rule changes multiple times a week and wants a same-day signal). off is safe only when the operator has an alternative drift-check discipline (a manual review after every change); the elicit prompts for the operator's choice at apply time.",
+  "alternativesConsidered": [],
+  "createdAt": "2026-09-07T22:00:00.000Z",
+  "updatedAt": "2026-09-07T22:00:00.000Z"
+}

package/blueprints/edge-cloudflare-rate-limiting/contributions/probes/event-secrecy.mjs

@@ -0,0 +1,104 @@
+// Probe: drift-audit event secrecy.
+//
+// anchorAcId: AC-36107-1. accountBound: false.
+//
+// Drives the shipped drift-audit runner realisation
+// (packages/rcf-lite/test/fixtures/cf-edge/src/drift-audit-runner.mjs)
+// with a synthetic manifest loader and a fake fetch that returns a
+// live-zone response with one mismatched rule. Asserts every record
+// on the sink carries only {ruleId, clientIpHash, outcome, timestamp,
+// diff} keys and NO full IPv4 or IPv6 address, NO body key, NO user
+// agent key. Under SIMULATE_EVENT_LEAK_IP=true the runner injects a
+// full client IP into the outcome so the probe surfaces the leak.
+
+import { FIXTURE_DIR } from './probe-utils.mjs';
+
+export const anchorAcId = 'AC-36107-1';
+export const accountBound = false;
+
+const IPV4 = /\b(?:25[0-5]|2[0-4]\d|[01]?\d?\d)(?:\.(?:25[0-5]|2[0-4]\d|[01]?\d?\d)){3}\b/;
+const IPV6 = /\b(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}\b/;
+const ALLOWED_KEYS = new Set(['ruleId', 'clientIpHash', 'outcome', 'timestamp', 'diff']);
+const FORBIDDEN_KEYS = new Set(['body', 'userAgent', 'user-agent', 'clientIp', 'ip', 'sourceIp']);
+
+function containsIp(text) {
+  if (typeof text !== 'string') return null;
+  const v4 = text.match(IPV4);
+  if (v4) return v4[0];
+  const v6 = text.match(IPV6);
+  if (v6) return v6[0];
+  return null;
+}
+
+export default async function runProbe() {
+  const runnerMod = await import(`${FIXTURE_DIR}/src/drift-audit-runner.mjs`);
+  const manifestRule = {
+    id: 'public-api-per-ip',
+    expression: '(http.request.uri.path matches "^/api/")',
+    threshold: 60,
+    period: 60,
+    characteristics: ['ip.src', 'cf.colo.id'],
+    action: 'block',
+    duration: 60,
+  };
+  const liveRule = { ...manifestRule, threshold: 90 };
+  const captured = [];
+  const eventSink = (record) => captured.push(record);
+  const fakeFetch = async () => ({
+    ok: true,
+    status: 200,
+    async json() { return { result: [liveRule] }; },
+  });
+  const runner = runnerMod.createDriftAuditRunner({
+    env: {
+      CF_ZONE_ID: 'fixture-zone-id',
+      SIMULATE_EVENT_LEAK_IP: process.env.SIMULATE_EVENT_LEAK_IP,
+    },
+    eventSink,
+    fetch: fakeFetch,
+    clock: () => '2026-09-07T22:00:00.000Z',
+    cadence: 'daily',
+    manifestLoader: async () => [manifestRule],
+  });
+  const report = await runner.runOnce();
+  const results = [];
+  if (captured.length === 0) {
+    results.push({ anchorAcId: 'AC-36107-1', verdict: 'fail', detail: 'drift-audit runner produced zero records; expected one for the threshold drift.' });
+    return { results };
+  }
+  let ipLeak = null;
+  let keyLeak = null;
+  for (const rec of captured) {
+    for (const k of Object.keys(rec)) {
+      if (FORBIDDEN_KEYS.has(k)) keyLeak = k;
+      if (!ALLOWED_KEYS.has(k)) keyLeak = keyLeak || `unexpected-key:${k}`;
+    }
+    for (const v of Object.values(rec)) {
+      if (typeof v === 'string') {
+        const hit = containsIp(v);
+        if (hit) ipLeak = hit;
+      }
+    }
+  }
+  if (keyLeak) {
+    results.push({ anchorAcId: 'AC-36107-1', verdict: 'fail', detail: `drift-audit record carries a forbidden or unexpected key: ${keyLeak}` });
+  }
+  if (ipLeak) {
+    results.push({ anchorAcId: 'AC-36107-1', verdict: 'fail', detail: `drift-audit record leaked a full IP address in a string field: ${ipLeak}` });
+  }
+  if (results.length === 0) {
+    results.push({
+      anchorAcId: 'AC-36107-1',
+      verdict: 'pass',
+      detail: `drift-audit runner produced ${captured.length} record(s); every record carries only ${[...ALLOWED_KEYS].join(', ')} and no full IP, body or user-agent field appears.`,
+    });
+  }
+  return {
+    results,
+    extra: {
+      recordCount: captured.length,
+      driftCount: report.driftCount,
+      allowedKeys: [...ALLOWED_KEYS],
+    },
+  };
+}