rcf-lite 0.23.0 → 0.24.0

package/blueprints/edge-cloudflare-rate-limiting/contributions/probes/manifest-presence.mjs

@@ -0,0 +1,95 @@
+// Probe: rate-limit manifest presence.
+//
+// anchorAcId: AC-36101-1 (also surfaces AC-36108-1's missing-file
+// negative through SIMULATE_MANIFEST_MISSING). accountBound: false.
+//
+// Reads the cf-edge fixture manifest directory (cloudflare/rate-limits/),
+// asserts:
+//   - at least one JSON file is present under the directory.
+//   - every file parses as JSON.
+//   - every file carries the seven required Cloudflare WAF rate-limiting
+//     rules fields (id, expression, threshold, period, characteristics,
+//     action, duration).
+//   - no file body carries a plaintext bearer token, private key or
+//     inline CF_API_TOKEN reference.
+//
+// Under SIMULATE_MANIFEST_MISSING=true the probe treats the first
+// manifest file as absent and returns aggregateVerdict: fail with
+// the missing basename named in the detail (AC-36108-1).
+
+import { readManifestFiles, scanForPlaintextSecrets, REQUIRED_FIELDS } from './probe-utils.mjs';
+
+export const anchorAcId = 'AC-36101-1';
+export const accountBound = false;
+
+export default async function runProbe() {
+  const { present, entries, files = [], hiddenBySimulate = [] } = await readManifestFiles();
+  const results = [];
+  if (!present) {
+    results.push({
+      anchorAcId: 'AC-36101-1',
+      verdict: 'fail',
+      detail: 'manifest directory holds zero JSON files; cf-edge fixture must ship at least one rule file under cloudflare/rate-limits/.',
+    });
+    return { results };
+  }
+  if (hiddenBySimulate.length > 0) {
+    results.push({
+      anchorAcId: 'AC-36108-1',
+      verdict: 'fail',
+      detail: `manifest file missing: ${hiddenBySimulate.join(', ')} (SIMULATE_MANIFEST_MISSING=true).`,
+    });
+    return { results };
+  }
+  let missingFieldCount = 0;
+  let plaintextCount = 0;
+  const fileFindings = [];
+  for (const f of files) {
+    let doc;
+    try {
+      doc = JSON.parse(f.text);
+    } catch (err) {
+      results.push({
+        anchorAcId: 'AC-36101-1',
+        verdict: 'fail',
+        detail: `manifest file ${f.name} does not parse as JSON: ${err.message}`,
+      });
+      continue;
+    }
+    const missing = REQUIRED_FIELDS.filter((k) => !(k in doc));
+    if (missing.length > 0) {
+      missingFieldCount += 1;
+      results.push({
+        anchorAcId: 'AC-36101-1',
+        verdict: 'fail',
+        detail: `manifest file ${f.name} missing required fields: ${missing.join(', ')}`,
+      });
+    }
+    const hits = scanForPlaintextSecrets(f.text);
+    if (hits.length > 0) {
+      plaintextCount += 1;
+      results.push({
+        anchorAcId: 'AC-36101-1',
+        verdict: 'fail',
+        detail: `manifest file ${f.name} carries plaintext secret pattern(s): ${hits.join(', ')}`,
+      });
+    }
+    fileFindings.push({ name: f.name, ruleId: doc.id ?? null });
+  }
+  if (results.length === 0) {
+    results.push({
+      anchorAcId: 'AC-36101-1',
+      verdict: 'pass',
+      detail: `${files.length} manifest file(s) inspected; every file carries the ${REQUIRED_FIELDS.length} required fields and no plaintext secret pattern was found.`,
+    });
+  }
+  return {
+    results,
+    extra: {
+      manifestFileCount: files.length,
+      manifestFiles: fileFindings,
+      missingFieldFileCount: missingFieldCount,
+      plaintextHitFileCount: plaintextCount,
+    },
+  };
+}

package/blueprints/edge-cloudflare-rate-limiting/contributions/probes/manifest-schema-validate.mjs

@@ -0,0 +1,130 @@
+// Probe: rate-limit manifest schema-validate.
+//
+// anchorAcId: AC-36106-1. accountBound: false.
+//
+// Reads the cf-edge fixture manifest directory, loads the shipped
+// JSON Schema (contributions/schemas/rate-limit-rule.schema.json,
+// draft-07) and validates every manifest file against it. A minimal
+// dependency-free validator covers the shape the schema commits to:
+// required-fields, type-per-field, integer-minimum, string-min-length,
+// non-empty-array and additionalProperties: false.
+//
+// Under SIMULATE_SCHEMA_INVALID=true the probe writes a scratch
+// manifest file that omits the threshold field so validation fails
+// with the offending field named in the detail.
+
+import { readdir, readFile, writeFile, unlink, mkdir } from 'node:fs/promises';
+import { join } from 'node:path';
+import { MANIFEST_DIR, REQUIRED_FIELDS, ACTION_ENUM, loadSchema } from './probe-utils.mjs';
+
+export const anchorAcId = 'AC-36106-1';
+export const accountBound = false;
+
+function validateDoc(doc, schema, filename) {
+  const failures = [];
+  if (typeof doc !== 'object' || doc === null || Array.isArray(doc)) {
+    failures.push(`${filename}: root is not a JSON object`);
+    return failures;
+  }
+  for (const required of schema.required) {
+    if (!(required in doc)) failures.push(`${filename}: missing required field ${required}`);
+  }
+  const props = schema.properties || {};
+  const allowed = new Set(Object.keys(props));
+  if (schema.additionalProperties === false) {
+    for (const key of Object.keys(doc)) {
+      if (!allowed.has(key)) failures.push(`${filename}: additional property not permitted: ${key}`);
+    }
+  }
+  for (const [key, def] of Object.entries(props)) {
+    if (!(key in doc)) continue;
+    const v = doc[key];
+    if (def.type === 'string') {
+      if (typeof v !== 'string') { failures.push(`${filename}: ${key} is not a string`); continue; }
+      if (typeof def.minLength === 'number' && v.length < def.minLength) failures.push(`${filename}: ${key} shorter than minLength ${def.minLength}`);
+      if (Array.isArray(def.enum) && !def.enum.includes(v)) failures.push(`${filename}: ${key} value ${JSON.stringify(v)} not in enum ${JSON.stringify(def.enum)}`);
+    } else if (def.type === 'integer') {
+      if (!Number.isInteger(v)) { failures.push(`${filename}: ${key} is not an integer`); continue; }
+      if (typeof def.minimum === 'number' && v < def.minimum) failures.push(`${filename}: ${key} value ${v} below minimum ${def.minimum}`);
+    } else if (def.type === 'array') {
+      if (!Array.isArray(v)) { failures.push(`${filename}: ${key} is not an array`); continue; }
+      if (typeof def.minItems === 'number' && v.length < def.minItems) failures.push(`${filename}: ${key} array shorter than minItems ${def.minItems}`);
+      if (def.items && def.items.type === 'string') {
+        v.forEach((item, i) => {
+          if (typeof item !== 'string') failures.push(`${filename}: ${key}[${i}] is not a string`);
+          else if (typeof def.items.minLength === 'number' && item.length < def.items.minLength) failures.push(`${filename}: ${key}[${i}] shorter than minLength ${def.items.minLength}`);
+        });
+      }
+    }
+  }
+  return failures;
+}
+
+export default async function runProbe() {
+  const schema = await loadSchema();
+  const simulateInvalid = process.env.SIMULATE_SCHEMA_INVALID === 'true';
+  const results = [];
+  const fileFindings = [];
+  let scratchPath = null;
+  try {
+    if (simulateInvalid) {
+      await mkdir(MANIFEST_DIR, { recursive: true });
+      scratchPath = join(MANIFEST_DIR, '__simulate-schema-invalid.json');
+      const invalidDoc = {
+        id: 'simulate-schema-invalid',
+        expression: '(http.request.uri.path matches "^/api/")',
+        period: 60,
+        characteristics: ['ip.src'],
+        action: 'block',
+        duration: 60,
+      };
+      await writeFile(scratchPath, JSON.stringify(invalidDoc, null, 2) + '\n', 'utf8');
+    }
+    const entries = (await readdir(MANIFEST_DIR)).filter((f) => f.endsWith('.json')).sort();
+    for (const name of entries) {
+      const text = await readFile(join(MANIFEST_DIR, name), 'utf8');
+      let doc;
+      try {
+        doc = JSON.parse(text);
+      } catch (err) {
+        results.push({
+          anchorAcId: 'AC-36106-1',
+          verdict: 'fail',
+          detail: `manifest file ${name} does not parse: ${err.message}`,
+        });
+        fileFindings.push({ name, valid: false, errors: [err.message] });
+        continue;
+      }
+      const failures = validateDoc(doc, schema, name);
+      if (failures.length > 0) {
+        results.push({
+          anchorAcId: 'AC-36106-1',
+          verdict: 'fail',
+          detail: failures.join('; '),
+        });
+        fileFindings.push({ name, valid: false, errors: failures });
+      } else {
+        fileFindings.push({ name, valid: true });
+      }
+    }
+  } finally {
+    if (scratchPath) {
+      try { await unlink(scratchPath); } catch {}
+    }
+  }
+  if (results.length === 0) {
+    results.push({
+      anchorAcId: 'AC-36106-1',
+      verdict: 'pass',
+      detail: `every manifest file validates against the shipped draft-07 schema (${fileFindings.length} file(s) inspected; required fields ${REQUIRED_FIELDS.join(', ')}; action enum ${ACTION_ENUM.join('/')}).`,
+    });
+  }
+  return {
+    results,
+    extra: {
+      schemaId: schema.$id,
+      manifestFileCount: fileFindings.length,
+      manifestFiles: fileFindings,
+    },
+  };
+}

package/blueprints/edge-cloudflare-rate-limiting/contributions/probes/probe-utils.mjs

@@ -0,0 +1,111 @@
+// Shared helpers for edge-cloudflare-rate-limiting probes.
+//
+// Runtime-dependency posture: three probes read the cf-edge fixture
+// manifest directory in-process (no network); one probe fires an
+// undici burst against a scheduled real-account URL when
+// CI_HAS_CLOUDFLARE_ACCOUNT and CF_RATE_LIMIT_URL are set, and
+// records accountBoundSkipped: true otherwise per spec section 3.5
+// and ruling 6. The drift-audit runner realisation lives in the
+// fixture at src/drift-audit-runner.mjs.
+
+import { mkdir, writeFile, readFile, readdir, rename, stat } from 'node:fs/promises';
+import { dirname, resolve, join, basename } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+
+export const PROJECT_ROOT = resolve(HERE, '..', '..', '..', '..');
+export const FIXTURE_DIR = resolve(PROJECT_ROOT, 'packages/rcf-lite/test/fixtures/cf-edge');
+export const MANIFEST_DIR = resolve(FIXTURE_DIR, 'cloudflare/rate-limits');
+export const SCHEMA_PATH = resolve(HERE, '..', 'schemas', 'rate-limit-rule.schema.json');
+export const REPORT_DIR = resolve(PROJECT_ROOT, '.rcf/reports/blueprints/edge-cloudflare-rate-limiting');
+
+export const REQUIRED_FIELDS = Object.freeze([
+  'id',
+  'expression',
+  'threshold',
+  'period',
+  'characteristics',
+  'action',
+  'duration',
+]);
+
+export const ACTION_ENUM = Object.freeze(['block', 'challenge', 'log', 'managed_challenge']);
+
+export function aggregate(results) {
+  if (results.some((r) => r.verdict === 'fail')) return 'fail';
+  if (results.some((r) => r.verdict === 'warn')) return 'warn';
+  return 'pass';
+}
+
+export async function writeReport({ probeName, engine, results, extra }) {
+  await mkdir(REPORT_DIR, { recursive: true });
+  const report = {
+    slug: 'edge-cloudflare-rate-limiting',
+    probeName,
+    runAt: new Date().toISOString(),
+    engine,
+    results,
+    aggregateVerdict: aggregate(results),
+    ...(extra ?? {}),
+  };
+  const path = resolve(REPORT_DIR, `${probeName}.json`);
+  await writeFile(path, JSON.stringify(report, null, 2) + '\n', 'utf8');
+  return { report, path };
+}
+
+export async function runShim(probeName, engine, mainFn) {
+  try {
+    const { results, extra } = await mainFn();
+    const { report, path } = await writeReport({ probeName, engine, results, extra });
+    process.stdout.write(JSON.stringify(report, null, 2) + '\n');
+    process.stdout.write(`report written to ${path}\n`);
+    if (report.aggregateVerdict === 'fail') process.exitCode = 1;
+  } catch (err) {
+    const results = [{
+      anchorAcId: 'unknown',
+      verdict: 'fail',
+      detail: `probe threw: ${err && err.message ? err.message : String(err)}`,
+    }];
+    const { report, path } = await writeReport({ probeName, engine, results });
+    process.stdout.write(JSON.stringify(report, null, 2) + '\n');
+    process.stderr.write(`probe error: ${err && err.stack ? err.stack : String(err)}\n`);
+    process.stderr.write(`report written to ${path}\n`);
+    process.exitCode = 1;
+  }
+}
+
+export async function readManifestFiles(dir = MANIFEST_DIR) {
+  const missing = process.env.SIMULATE_MANIFEST_MISSING === 'true';
+  let entries;
+  try {
+    entries = (await readdir(dir)).filter((f) => f.endsWith('.json')).sort();
+  } catch (err) {
+    return { present: false, missing: [], entries: [], error: err.message };
+  }
+  const hidden = new Set();
+  if (missing && entries.length > 0) {
+    hidden.add(entries[0]);
+  }
+  const files = [];
+  for (const name of entries) {
+    if (hidden.has(name)) continue;
+    const p = join(dir, name);
+    const text = await readFile(p, 'utf8');
+    files.push({ name, path: p, text });
+  }
+  return { present: entries.length > 0, entries, files, hiddenBySimulate: [...hidden] };
+}
+
+export function scanForPlaintextSecrets(text) {
+  const hits = [];
+  if (/[Bb]earer\s+[A-Za-z0-9._-]{20,}/.test(text)) hits.push('bearer-token-like');
+  if (/-----BEGIN [A-Z ]*PRIVATE KEY-----/.test(text)) hits.push('pem-private-key');
+  if (/"?CF_API_TOKEN"?\s*:\s*"[^"]{5,}"/.test(text)) hits.push('inline-cf-api-token');
+  return hits;
+}
+
+export async function loadSchema() {
+  const raw = await readFile(SCHEMA_PATH, 'utf8');
+  return JSON.parse(raw);
+}

package/blueprints/edge-cloudflare-rate-limiting/contributions/probes/real-account-burst-and-429.mjs

@@ -0,0 +1,104 @@
+// Probe: real-account burst-and-429 against a scheduled URL.
+//
+// anchorAcId: AC-36103-1. accountBound: true.
+//
+// When CI_HAS_CLOUDFLARE_ACCOUNT=true AND CF_RATE_LIMIT_URL is set,
+// the probe fires an in-process burst against the scheduled URL and
+// asserts:
+//   - the (N+1)th and subsequent requests within the elicited
+//     duration return HTTP 429.
+//   - the 429 responses carry a Retry-After header consistent with
+//     the elicited duration.
+//   - the 429 responses carry a Cf-Ray header naming the CF edge.
+//
+// Without either env var the probe records accountBoundSkipped: true
+// and aggregates to pass per spec section 3.5 and ruling 6.
+// N (the elicited threshold) is read from CF_RATE_LIMIT_THRESHOLD
+// (default 60); the burst count is N+3.
+
+export const anchorAcId = 'AC-36103-1';
+export const accountBound = true;
+
+const BURST_TIMEOUT_MS = 10000;
+
+async function fireOne(url) {
+  const ctrl = new AbortController();
+  const to = setTimeout(() => ctrl.abort(), BURST_TIMEOUT_MS);
+  try {
+    const res = await fetch(url, { method: 'GET', redirect: 'manual', signal: ctrl.signal });
+    return { status: res.status, retryAfter: res.headers.get('retry-after'), cfRay: res.headers.get('cf-ray') };
+  } finally {
+    clearTimeout(to);
+  }
+}
+
+export default async function runProbe() {
+  const has = process.env.CI_HAS_CLOUDFLARE_ACCOUNT === 'true';
+  const url = process.env.CF_RATE_LIMIT_URL || '';
+  if (!has || !url) {
+    return {
+      results: [{
+        anchorAcId: 'AC-36103-1',
+        verdict: 'pass',
+        accountBoundSkipped: true,
+        detail: `accountBoundSkipped: CI_HAS_CLOUDFLARE_ACCOUNT=${has} CF_RATE_LIMIT_URL=${url ? 'set' : 'unset'}; per spec section 3.5 and ruling 6 pass-with-skip.`,
+      }],
+      extra: { accountBoundSkipped: true },
+    };
+  }
+  const threshold = Number.parseInt(process.env.CF_RATE_LIMIT_THRESHOLD || '60', 10);
+  const burstCount = threshold + 3;
+  const results429 = [];
+  const responses = [];
+  try {
+    for (let i = 0; i < burstCount; i += 1) {
+      const r = await fireOne(url);
+      responses.push(r);
+      if (r.status === 429) results429.push(r);
+    }
+  } catch (err) {
+    return {
+      results: [{
+        anchorAcId: 'AC-36103-1',
+        verdict: 'fail',
+        detail: `real-account burst threw before completion: ${err && err.message ? err.message : String(err)}`,
+      }],
+      extra: { accountBound: true, responsesFired: responses.length },
+    };
+  }
+  const results = [];
+  if (results429.length < 2) {
+    results.push({
+      anchorAcId: 'AC-36103-1',
+      verdict: 'fail',
+      detail: `burst of ${burstCount} produced ${results429.length} 429 response(s); expected at least the ${burstCount - threshold} requests above the elicited threshold to return 429.`,
+    });
+  }
+  const missingRetryAfter = results429.filter((r) => !r.retryAfter);
+  if (missingRetryAfter.length > 0) {
+    results.push({
+      anchorAcId: 'AC-36103-1',
+      verdict: 'fail',
+      detail: `${missingRetryAfter.length} of the 429 response(s) missing a Retry-After header; the Cloudflare WAF rate-limiting rules documented shape names Retry-After as the value the client honours.`,
+    });
+  }
+  const missingCfRay = results429.filter((r) => !r.cfRay);
+  if (missingCfRay.length > 0) {
+    results.push({
+      anchorAcId: 'AC-36103-1',
+      verdict: 'fail',
+      detail: `${missingCfRay.length} of the 429 response(s) missing a Cf-Ray header; the header identifies the CF edge that served the refusal.`,
+    });
+  }
+  if (results.length === 0) {
+    results.push({
+      anchorAcId: 'AC-36103-1',
+      verdict: 'pass',
+      detail: `burst of ${burstCount} produced ${results429.length} 429 response(s), every 429 carries Retry-After and Cf-Ray; over-threshold behaviour confirmed against the scheduled URL.`,
+    });
+  }
+  return {
+    results,
+    extra: { accountBound: true, responsesFired: responses.length, count429: results429.length, threshold },
+  };
+}

package/blueprints/edge-cloudflare-rate-limiting/contributions/probes/run-event-secrecy.mjs

@@ -0,0 +1,5 @@
+import runProbe from './event-secrecy.mjs';
+import { runShim } from './probe-utils.mjs';
+
+const engine = { kind: 'event-sink-accumulation', image: 'cf-edge fixture drift-audit runner driven with synthetic manifest and fake fetch (in-process)', healthy: true };
+runShim('event-secrecy', engine, runProbe);

package/blueprints/edge-cloudflare-rate-limiting/contributions/probes/run-manifest-presence.mjs

@@ -0,0 +1,5 @@
+import runProbe from './manifest-presence.mjs';
+import { runShim } from './probe-utils.mjs';
+
+const engine = { kind: 'source-scan', image: 'cf-edge fixture manifest directory (in-process JSON read)', healthy: true };
+runShim('manifest-presence', engine, runProbe);

package/blueprints/edge-cloudflare-rate-limiting/contributions/probes/run-manifest-schema-validate.mjs

@@ -0,0 +1,5 @@
+import runProbe from './manifest-schema-validate.mjs';
+import { runShim } from './probe-utils.mjs';
+
+const engine = { kind: 'source-scan', image: 'cf-edge fixture manifest directory validated against draft-07 JSON Schema (in-process)', healthy: true };
+runShim('manifest-schema-validate', engine, runProbe);

package/blueprints/edge-cloudflare-rate-limiting/contributions/probes/run-real-account-burst-and-429.mjs

@@ -0,0 +1,5 @@
+import runProbe from './real-account-burst-and-429.mjs';
+import { runShim } from './probe-utils.mjs';
+
+const engine = { kind: 'real-account', image: 'undici burst against scheduled Cloudflare-fronted URL', healthy: true };
+runShim('real-account-burst-and-429', engine, runProbe);

package/blueprints/edge-cloudflare-rate-limiting/contributions/requirements/edge-cloudflare-rate-limiting-req-001.json

@@ -0,0 +1,17 @@
+{
+  "reqId": "edge-cloudflare-rate-limiting-REQ-001",
+  "prdId": "PRD-001",
+  "title": "The rate-limit rule set is committed to the applying project as a local manifest under cloudflare/rate-limits/, one JSON file per rule",
+  "description": "The applying project holds its rate-limit rule set as a set of JSON documents under the elicited rate-limit-rules-dir (default cloudflare/rate-limits/), one file per rule per ADR-3703. Every manifest file declares the seven documented fields the Cloudflare WAF rate-limiting rules contract names per https://developers.cloudflare.com/waf/rate-limiting-rules/: id (a stable operator-facing string), expression (the WAF rules-language expression string), threshold (positive integer), period (seconds), characteristics (non-empty array of stable characteristic strings), action (block or challenge or log or managed_challenge), duration (seconds, the length of the block window). No rule references a secret in plaintext; the zone id is elicited and stored via the applied secretsManagement companion. The manifest is the source of truth an operator applies via the wrangler or dashboard flow named in the guide; no committed script writes the rules to the live zone.",
+  "category": "functional",
+  "domain": "edge",
+  "priority": "must",
+  "rationale": "Ratified in the Cloudflare round 6 spec (cloudflare-round-6-spec-2026-09-06.md section 5.6). Ships as v1.0.0 of edge-cloudflare-rate-limiting.",
+  "tags": [
+    "blueprint:edge-cloudflare-rate-limiting"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-07T22:00:00.000Z",
+  "updatedAt": "2026-09-07T22:00:00.000Z"
+}

package/blueprints/edge-cloudflare-rate-limiting/contributions/requirements/edge-cloudflare-rate-limiting-req-002.json

@@ -0,0 +1,17 @@
+{
+  "reqId": "edge-cloudflare-rate-limiting-REQ-002",
+  "prdId": "PRD-001",
+  "title": "The operator-facing management surface is a documented wrangler or Cloudflare-dashboard flow that applies the local manifest to the live zone",
+  "description": "The blueprint ships no committed script that writes rules to the live Cloudflare zone. The applying project's operator applies the manifest to the elicited zone through one of two documented flows per TAC-3702 and the guide: a wrangler-based flow (the guide names the exact wrangler subcommands the operator runs; commits an audit trail through the wrangler history) or a Cloudflare-dashboard flow (the guide walks the dashboard screens the operator clicks per https://developers.cloudflare.com/waf/rate-limiting-rules/). The elicited rate-limit-management-surface value records the flow the operator chose; the guide's copy-paste walkthrough covers both. The intent is a management surface an operator can hand-run at a known cadence and reproduce from the manifest without inventing a bespoke deploy tool.",
+  "category": "operational",
+  "domain": "edge",
+  "priority": "must",
+  "rationale": "Ratified in the Cloudflare round 6 spec (cloudflare-round-6-spec-2026-09-06.md section 5.6). Ships as v1.0.0 of edge-cloudflare-rate-limiting.",
+  "tags": [
+    "blueprint:edge-cloudflare-rate-limiting"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-07T22:00:00.000Z",
+  "updatedAt": "2026-09-07T22:00:00.000Z"
+}

package/blueprints/edge-cloudflare-rate-limiting/contributions/requirements/edge-cloudflare-rate-limiting-req-003.json

@@ -0,0 +1,17 @@
+{
+  "reqId": "edge-cloudflare-rate-limiting-REQ-003",
+  "prdId": "PRD-001",
+  "title": "Over-threshold behaviour: the (N+1)th and subsequent requests within the elicited duration return 429 with Retry-After and Cf-Ray, and the origin never sees them",
+  "description": "Given a rule that permits N requests per period on a characteristic set, when a client sends the (N+1)th request within that period, Cloudflare's zone-level rate limiter refuses the request at the edge for the elicited duration. The refusal response is HTTP 429 with a Retry-After header naming a value consistent with the elicited duration and a Cf-Ray header identifying the CF edge that served the refusal per the Cloudflare WAF rate-limiting rules documented shape at https://developers.cloudflare.com/waf/rate-limiting-rules/. The origin Worker never sees the refused requests. This is the runtime observable AC-rateLimiting-overThresholdBlocks binds; the runtime verification is the real-account burst probe per REQ-004's account-bound category, and per ruling 6 the local CI records accountBound: skipped without CI_HAS_CLOUDFLARE_ACCOUNT.",
+  "category": "functional",
+  "domain": "edge",
+  "priority": "must",
+  "rationale": "Ratified in the Cloudflare round 6 spec (cloudflare-round-6-spec-2026-09-06.md section 5.6). Ships as v1.0.0 of edge-cloudflare-rate-limiting.",
+  "tags": [
+    "blueprint:edge-cloudflare-rate-limiting"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-07T22:00:00.000Z",
+  "updatedAt": "2026-09-07T22:00:00.000Z"
+}

package/blueprints/edge-cloudflare-rate-limiting/contributions/requirements/edge-cloudflare-rate-limiting-req-004.json

@@ -0,0 +1,17 @@
+{
+  "reqId": "edge-cloudflare-rate-limiting-REQ-004",
+  "prdId": "PRD-001",
+  "title": "Drift audit: an opt-in scheduled runner reads live zone rules via the Cloudflare API and diffs against the local manifest, reporting mismatches metadata-only",
+  "description": "The blueprint ships a scheduled drift-audit runner (TAC-3703) the applying project can wire behind the elicited rate-limit-drift-audit-cadence per ADR-3704. When enabled (daily or hourly), the runner fetches the live rate-limiting rules on the elicited zone via the Cloudflare API, diffs the returned rule set against the local manifest field-by-field, and constructs one drift-audit record per mismatched rule. Each record is written through the applied logger's audit sink with the metadata-only shape {ruleId, clientIpHash, outcome, timestamp} plus the diff fields; a record never carries a full client IP, a request body or a user agent per REQ-005's event-secrecy discipline. The runner's report artefact writes to the standard blueprint-report location under .rcf/reports/blueprints/edge-cloudflare-rate-limiting/. When the elicited cadence is off, the runner is not wired.",
+  "category": "operational",
+  "domain": "edge",
+  "priority": "must",
+  "rationale": "Ratified in the Cloudflare round 6 spec (cloudflare-round-6-spec-2026-09-06.md section 5.6). Ships as v1.0.0 of edge-cloudflare-rate-limiting.",
+  "tags": [
+    "blueprint:edge-cloudflare-rate-limiting"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-07T22:00:00.000Z",
+  "updatedAt": "2026-09-07T22:00:00.000Z"
+}

package/blueprints/edge-cloudflare-rate-limiting/contributions/requirements/edge-cloudflare-rate-limiting-req-005.json

@@ -0,0 +1,17 @@
+{
+  "reqId": "edge-cloudflare-rate-limiting-REQ-005",
+  "prdId": "PRD-001",
+  "title": "Composition with security-auth-magic-link: the zone-level rate rule layers over the per-email application rule",
+  "description": "When both edge-cloudflare-rate-limiting and security-auth-magic-link are applied on the same project, the composition follows ADR-3702: the zone-level rate rule sits at the CF edge and refuses the (N+1)th request for the elicited duration before it reaches the origin Worker; the per-email application rate limiter that security-auth-magic-link ships continues to run on requests that pass the edge gate, applying per-email per-minute limits at the mint-surface. Zone rule layers OVER the application rule; the two operate on different characteristic sets (IP-per-URL at the zone, email at the application) and never overlap on the same characteristic. The guide names the composition explicitly with a copy-paste example. Applying both blueprints without the ADR-3702 layering understanding would leave two rate rules operating on the same characteristic and shadowing each other; ADR-3702 states the layering explicitly and the applied recorder records both blueprints so the operator sees the two-rule shape at apply time.",
+  "category": "functional",
+  "domain": "edge",
+  "priority": "should",
+  "rationale": "Ratified in the Cloudflare round 6 spec (cloudflare-round-6-spec-2026-09-06.md section 5.6). Ships as v1.0.0 of edge-cloudflare-rate-limiting.",
+  "tags": [
+    "blueprint:edge-cloudflare-rate-limiting"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-07T22:00:00.000Z",
+  "updatedAt": "2026-09-07T22:00:00.000Z"
+}

package/blueprints/edge-cloudflare-rate-limiting/contributions/schemas/rate-limit-rule.schema.json

@@ -0,0 +1,67 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "https://stravica.ai/rcf-lite/schemas/rate-limit-rule.schema.json",
+  "title": "Cloudflare rate-limit rule manifest file",
+  "description": "One rule per file under the elicited rate-limit-rules-dir. Fields track the Cloudflare WAF rate-limiting rules documented shape at https://developers.cloudflare.com/waf/rate-limiting-rules/.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "id",
+    "expression",
+    "threshold",
+    "period",
+    "characteristics",
+    "action",
+    "duration"
+  ],
+  "properties": {
+    "id": {
+      "type": "string",
+      "minLength": 1,
+      "description": "Operator-facing stable rule id (kebab-case; used in drift-audit records as ruleId)."
+    },
+    "expression": {
+      "type": "string",
+      "minLength": 1,
+      "description": "Cloudflare WAF rules-language expression string; scopes the rule to a request set."
+    },
+    "threshold": {
+      "type": "integer",
+      "minimum": 1,
+      "description": "Requests permitted per period on the characteristic set."
+    },
+    "period": {
+      "type": "integer",
+      "minimum": 1,
+      "description": "Window in seconds the threshold applies over."
+    },
+    "characteristics": {
+      "type": "array",
+      "minItems": 1,
+      "items": {
+        "type": "string",
+        "minLength": 1
+      },
+      "description": "Non-empty list of characteristic strings the rule keys on (e.g. cf.colo.id, ip.src, http.host + http.request.uri.path)."
+    },
+    "action": {
+      "type": "string",
+      "enum": [
+        "block",
+        "challenge",
+        "log",
+        "managed_challenge"
+      ],
+      "description": "Cloudflare-documented action verb the rule applies over-threshold."
+    },
+    "duration": {
+      "type": "integer",
+      "minimum": 1,
+      "description": "Block window in seconds the (N+1)th and subsequent requests are refused for."
+    },
+    "description": {
+      "type": "string",
+      "description": "Optional operator-facing description of the rule intent."
+    }
+  }
+}