rcf-lite 0.23.0 → 0.25.0

package/blueprints/platform-cloudflare-kv/contributions/user-stories/platform-cloudflare-kv-us-31101.json

@@ -0,0 +1,27 @@
+{
+  "usId": "platform-cloudflare-kv-US-31101",
+  "prdId": "PRD-001",
+  "reqId": "platform-cloudflare-kv-REQ-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "The KV facade opens against the elicited binding on boot and emits facadeReady",
+  "asA": "developer whose Worker or Node service needs a small durable KV surface behind a swappable boundary",
+  "iWant": "one KV facade module to hold the Cloudflare Workers KV binding reference and expose typed domain verbs (get, getWithMetadata, put, delete, list), with a facadeReady lifecycle event on the first successful ready-check",
+  "soThat": "the boundary between my domain and the vendor surface is the only place that has to move when the adapter changes, and boot ordering is observable via the event",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-31101-1",
+      "description": "On process boot, the facade opens against the elicited KV binding (env.CACHE on the fixture); once the ready-check resolves, a facadeReady event fires on the injected event sink with a payload of exactly {event, key, size, ttl, timestamp}. The facade exposes typed named domain verbs (get, getWithMetadata, put, delete, list) and does NOT re-export the raw binding.",
+      "given": "a Node or Worker process with the facade module imported and its factory invoked with the elicited binding",
+      "when": "the process boots and the facade ready() call resolves",
+      "then": "a facadeReady event fires on the injected event sink with the metadata-only payload; the facade exposes named domain verbs only; the raw binding is not re-exported",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-3201-platform-cloudflare-kv-facade"
+  ],
+  "createdAt": "2026-09-07T10:27:19.000Z",
+  "updatedAt": "2026-09-07T10:27:19.000Z"
+}

package/blueprints/platform-cloudflare-kv/contributions/user-stories/platform-cloudflare-kv-us-31102.json

@@ -0,0 +1,27 @@
+{
+  "usId": "platform-cloudflare-kv-US-31102",
+  "prdId": "PRD-001",
+  "reqId": "platform-cloudflare-kv-REQ-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "The KV binding reference is dereferenced in exactly one module on the applied fixture",
+  "asA": "operator applying platform-cloudflare-kv v1.0.0",
+  "iWant": "a grep for env.<binding> on the applied fixture src/ tree to return exactly the facade module and no other file",
+  "soThat": "the vendor surface is diffused across zero call sites outside the facade, and a future adapter swap lands without moving any AC",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-31102-1",
+      "description": "A grep for env.CACHE in the cf-platform fixture src/ tree returns exactly one file: src/kv-facade.mjs. No other module dereferences the raw KV binding. The public surface of src/kv-facade.mjs exports the createKvFacade factory only; the raw env.CACHE reference never crosses the module boundary.",
+      "given": "the applied project source tree after apply",
+      "when": "grep -rn env.CACHE walks the src/ tree",
+      "then": "the search returns one file src/kv-facade.mjs and no other match",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-3201-platform-cloudflare-kv-facade"
+  ],
+  "createdAt": "2026-09-07T10:27:19.000Z",
+  "updatedAt": "2026-09-07T10:27:19.000Z"
+}

package/blueprints/platform-cloudflare-kv/contributions/user-stories/platform-cloudflare-kv-us-31103.json

@@ -0,0 +1,36 @@
+{
+  "usId": "platform-cloudflare-kv-US-31103",
+  "prdId": "PRD-001",
+  "reqId": "platform-cloudflare-kv-REQ-002",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Typed put and get round-trip a value through the KV driver realising the Workers KV binding shape",
+  "asA": "developer using the facade behind an app request handler",
+  "iWant": "facade.put(key, value) then facade.get(key) to return the same bytes, with paired kvWrite and kvHit events",
+  "soThat": "a request handler can persist and read state deterministically through one seam",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-31103-1",
+      "description": "facade.put(key, value) writes a value; facade.get(key) returns the same bytes; both operations emit their paired lifecycle events (kvWrite on put, kvHit on get). The round-trip works against the in-memory KV driver in the cf-platform fixture (src/kv-driver.mjs) whose binding shape matches the real Workers KV binding contract per https://developers.cloudflare.com/kv/api/.",
+      "given": "the facade wired to the in-memory KV driver in the cf-platform fixture",
+      "when": "the facade-round-trip probe puts a fixture key/value and reads it back",
+      "then": "the read returns the same bytes; the event sink records one kvWrite and one kvHit; the probe report aggregates to pass",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-31103-2",
+      "description": "facade.delete(key) removes a value; a subsequent facade.get(key) returns null and emits kvMiss.",
+      "given": "a key previously put via the facade",
+      "when": "facade.delete(key) then facade.get(key)",
+      "then": "the delete emits kvWrite; the get returns null and emits kvMiss",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-3201-platform-cloudflare-kv-facade"
+  ],
+  "createdAt": "2026-09-07T10:27:19.000Z",
+  "updatedAt": "2026-09-07T10:27:19.000Z"
+}

package/blueprints/platform-cloudflare-kv/contributions/user-stories/platform-cloudflare-kv-us-31104.json

@@ -0,0 +1,27 @@
+{
+  "usId": "platform-cloudflare-kv-US-31104",
+  "prdId": "PRD-001",
+  "reqId": "platform-cloudflare-kv-REQ-002",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "facade.list({prefix}) returns every key under a prefix with metadata shape intact",
+  "asA": "developer maintaining a set of prefix-scoped feature flags",
+  "iWant": "facade.list({prefix: flags/}) to return every key under the prefix with metadata shape",
+  "soThat": "the applied project can enumerate a prefix-scoped collection through one seam",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-31104-1",
+      "description": "The list-with-prefix probe puts 10 keys under the prefix flags/ (each with a metadata blob) and calls facade.list({prefix: flags/}). The result returns all 10 keys, each entry carrying {name, metadata}, and every name preserves the domain-visible key. A decoy key outside the prefix is NOT included.",
+      "given": "10 keys put under a shared prefix through the facade plus one decoy outside the prefix",
+      "when": "facade.list({prefix: flags/}) runs",
+      "then": "the result carries 10 entries with correct name and metadata fields; the decoy is absent; the aggregate probe verdict is pass",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-3201-platform-cloudflare-kv-facade"
+  ],
+  "createdAt": "2026-09-07T10:27:19.000Z",
+  "updatedAt": "2026-09-07T10:27:19.000Z"
+}

package/blueprints/platform-cloudflare-kv/contributions/user-stories/platform-cloudflare-kv-us-31105.json

@@ -0,0 +1,27 @@
+{
+  "usId": "platform-cloudflare-kv-US-31105",
+  "prdId": "PRD-001",
+  "reqId": "platform-cloudflare-kv-REQ-003",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Cache-aside helper: within-TTL second read is a cache hit and origin is called once",
+  "asA": "developer wrapping a downstream origin call with cache-aside",
+  "iWant": "cache-aside.getOr to invoke origin once on miss, write back with the elicited TTL, and serve subsequent within-TTL reads from cache",
+  "soThat": "the origin surface (a database, a downstream service) is spared one call per cached hit within TTL",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-31105-1",
+      "description": "On first call, cache-aside.getOr(key, originFn) finds nothing in the facade, invokes originFn once, writes back with the elicited TTL, and returns the fresh value with source origin. On the second call within TTL, the read is served from the facade (source cache) and originFn is NOT invoked (the invocation counter stays at 1).",
+      "given": "a fresh key and an origin function that increments a counter each call",
+      "when": "getOr(key, originFn) runs twice within TTL",
+      "then": "the invocation counter reaches 1; both calls return the same value; the second read reports source cache",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-3202-platform-cloudflare-kv-cache-aside"
+  ],
+  "createdAt": "2026-09-07T10:27:19.000Z",
+  "updatedAt": "2026-09-07T10:27:19.000Z"
+}

package/blueprints/platform-cloudflare-kv/contributions/user-stories/platform-cloudflare-kv-us-31106.json

@@ -0,0 +1,27 @@
+{
+  "usId": "platform-cloudflare-kv-US-31106",
+  "prdId": "PRD-001",
+  "reqId": "platform-cloudflare-kv-REQ-003",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Cache-aside helper: past-TTL read miss triggers a second origin call",
+  "asA": "developer relying on cache-aside for staleness bounds",
+  "iWant": "the cache-aside helper to re-invoke origin after the elicited TTL elapses",
+  "soThat": "the applied project observes a bounded staleness ceiling that matches the elicited TTL",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-31106-1",
+      "description": "After the TTL elapses (in-memory driver clock advances past the expiration), cache-aside.getOr(key, originFn) finds nothing and invokes originFn a second time. The invocation counter reaches 2 and the returned value comes from origin.",
+      "given": "a key past its TTL",
+      "when": "getOr(key, originFn) runs after clock advance past TTL",
+      "then": "the invocation counter reaches 2; the returned value comes from origin",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-3202-platform-cloudflare-kv-cache-aside"
+  ],
+  "createdAt": "2026-09-07T10:27:19.000Z",
+  "updatedAt": "2026-09-07T10:27:19.000Z"
+}

package/blueprints/platform-cloudflare-kv/contributions/user-stories/platform-cloudflare-kv-us-31107.json

@@ -0,0 +1,27 @@
+{
+  "usId": "platform-cloudflare-kv-US-31107",
+  "prdId": "PRD-001",
+  "reqId": "platform-cloudflare-kv-REQ-004",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Lifecycle events carry only the metadata-only whitelist",
+  "asA": "operator running the applied logging companion against the KV facade",
+  "iWant": "every lifecycle event on the injected sink to carry only {event, key, size, ttl, timestamp} and nothing else",
+  "soThat": "the log stream can render KV activity without ever writing a body byte or a metadata blob",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-31107-1",
+      "description": "Each lifecycle event emitted by the facade carries EXACTLY the whitelist {event, key, size, ttl, timestamp}. No body value, no metadata blob, no additional field ever appears on the record the sink receives. A whitelist scan on the recorded events returns zero forbidden keys.",
+      "given": "the facade wired to a spy event sink, with a mix of put/get/delete/list operations",
+      "when": "the operations run",
+      "then": "the sink records each event with only the whitelist keys; any extra key trips the probe",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-3203-platform-cloudflare-kv-event-sink"
+  ],
+  "createdAt": "2026-09-07T10:27:19.000Z",
+  "updatedAt": "2026-09-07T10:27:19.000Z"
+}

package/blueprints/platform-cloudflare-kv/contributions/user-stories/platform-cloudflare-kv-us-31108.json

@@ -0,0 +1,27 @@
+{
+  "usId": "platform-cloudflare-kv-US-31108",
+  "prdId": "PRD-001",
+  "reqId": "platform-cloudflare-kv-REQ-004",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Event secrecy: no body bytes or PII reach the sink under a mutation-run",
+  "asA": "operator running the event-secrecy probe on a PII fixture",
+  "iWant": "the probe to prove zero body / PII / user id substring leaves the facade via the sink under both the shipped code path and a mutation-run",
+  "soThat": "the estate can trust the facade never leaks the body to the log stream even when a downstream change tries to",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-31108-1",
+      "description": "The event-secrecy probe puts, gets and deletes a PII fixture (key users/1234/profile, body containing REDACTED-fixture SSN); every event record on the sink carries only the whitelist and no substring of the SSN, no substring of the user id beyond the key itself, and no substring of the body. A mutation-run turning on SIMULATE_PII_LEAK flips the probe to fail with the leaked field named.",
+      "given": "the facade wired to a spy sink with a PII fixture",
+      "when": "put/get/delete operations run on the PII key with the mutation-run switch off then on",
+      "then": "the recorded events contain only the whitelist; PII-substring scan returns zero hits; the mutation-run under SIMULATE_PII_LEAK trips the probe to fail",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-3203-platform-cloudflare-kv-event-sink"
+  ],
+  "createdAt": "2026-09-07T10:27:19.000Z",
+  "updatedAt": "2026-09-07T10:27:19.000Z"
+}

package/blueprints/platform-cloudflare-kv/docs/topics.md

@@ -0,0 +1,74 @@
+# platform-cloudflare-kv blueprint coordination vocabulary
+
+This file is the platform-cloudflare-kv half of the cross-blueprint contract. The Phase 1 conflict detector matches scope:global ADR topics by EXACT string equality, and AC ids are unnamespaced by the 0.4.4 grammar. Any blueprint intended to compose with this one must reuse these exact strings and respect these bands.
+
+## Global ADR topics this blueprint contributes (exact strings)
+
+| Topic string | platform-cloudflare-kv contribution | Origin | Composition note |
+|---|---|---|---|
+| `keyValueStoreContract` | ADR-3201-platform-cloudflare-kv-key-value-store-contract | Minted by this blueprint. Names the wire-shape contract for a key-value store the applied Workers project reads through a facade; the shipped answer is Cloudflare Workers KV with its documented eventual-consistency semantics per https://developers.cloudflare.com/kv/concepts/how-kv-works/. | The one project-wide decision on the key-value-store contract at the facade boundary. A future non-KV adapter (a Redis-shape store, a strong-consistency Durable Objects cell for a single-owner use case) would contribute the same topic string with a different answer, forcing a DELIBERATE conflict the operator resolves with a project-level ADR |
+
+The platform-cloudflare-kv blueprint claims one global topic. Every other contribution is scope-local (ADR-3202 default cache-aside TTL, ADR-3203 key naming convention do not contribute global topics; a composing blueprint that holds an opinion on either authors its own project-level ADR).
+
+Rules for new topics: lower camel case, one concept per topic, no version suffixes. A topic names the decision area, not the chosen answer.
+
+## Id number bands (registry bootstrap)
+
+This table is maintained shelf-wide across every blueprint's `docs/topics.md`. Rows are recorded at ship, never predicted.
+
+| Blueprint | US band | ADR/TAC suffix block | Status | Global topics |
+|---|---|---|---|---|
+| application-spa | 1101-1899 | 2xx | shipped v1.3.0 | `clientRouting`, `theming`, `clientState`, `errorEnvelope`, `authModel` |
+| application-api-rest | 2101-2899 | 3xx | shipped v1.0.0 | `errorEnvelope`, `authModel`, `apiVersioning`, `logging` |
+| security-auth-magic-link | 3101-3899 | 5xx | shipped v1.0.0 | `authModel` |
+| email-smtp-resend | 4101-4899 | 4xx | shipped v1.0.0 | none |
+| hello-panel (walkthrough exemplar) | 4101-4899 | 4xx | doc-reserved; teaching exemplar in `packages/rcf-lite/docs/blueprint-authoring-walkthrough.md`, not shipped as a blueprint directory | `operatorPanel` |
+| persistence-data-sqlite | 5101-5899 | 6xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
+| delivery-ci-workflows | 6101-6899 | 7xx | shipped v2.0.0 (renamed from ci-pipeline) | `ciGates`, `strictCoverageGate`, `releaseArtefacts` |
+| observability-essentials | 7101-7899 | 8xx | shipped v2.0.0 | `statusPageContract` |
+| security-secrets-management | 8101-8899 | 9xx | shipped v1.0.1 | `secretsSource` |
+| security-auth-clerk | 9101-9899 | 10xx | shipped v1.0.0 | `authModel` |
+| security-auth-oauth2 | 10101-10899 | 11xx | shipped v1.0.0 | `authModel` |
+| security-auth-keycloak | 11101-11899 | 12xx | shipped v1.0.0 | `authModel` |
+| deploy-cloudflare-workers | 12101-12899 | 13xx | shipped v1.2.0 | `deploymentTarget` |
+| persistence-data-d1 | 13101-13899 | 14xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
+| observability-probe-endpoints | 14101-14899 | 15xx | shipped v1.1.0 | `healthProbes`, `readinessSemantics` |
+| observability-logging | 15101-15899 | 16xx | shipped v1.0.0 | `logging` |
+| application-error-handling | 16101-16899 | 17xx | shipped v1.0.0 | `errorHandling` |
+| application-datatable | 17101-17899 | 18xx | shipped v1.0.0 | none |
+| application-charts | 18101-18899 | 19xx | shipped v1.0.0 | none |
+| application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
+| application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
+| application-admin-console | 21101-21899 | 22xx | shipped v1.1.0 | `adminConsoleSignInSurface` |
+| application-empty-error-states | 22101-22899 | 23xx | shipped v1.0.0 | none |
+| application-file-upload | 23101-23899 | 24xx | shipped v1.0.0 | none |
+| application-forms-wizard | 24101-24899 | 25xx | shipped v1.0.0 | none |
+| application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
+| application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
+| persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
+| jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
+| platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |
+| platform-cloudflare-cron-triggers | 32101-32899 | 33xx | shipped v1.0.0 | `scheduledTriggerContract` |
+| platform-cloudflare-durable-objects | 33101-33899 | 34xx | shipped v1.0.0 | `strongConsistencyCellContract`, `websocketHubContract` |
+| edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
+| edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
+| edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
+| deploy-hetzner-server | 37101-37899 | 38xx | shipped v1.0.0 | `linuxCloudHostContract`, `snapshotAndBackupCadence` |
+| platform-docker-compose-host | 38101-38899 | 39xx | shipped v1.0.0 | `containerHostContract` |
+| edge-cloudflare-tunnel | 39101-39899 | 40xx | shipped v1.0.0 | `edgeIngressBridge` |
+
+US 31101-31108 sit at the LOW end of the 31101-31899 band on purpose (watchpost run-4 lesson). A project-side story mechanically derived from a platform-cloudflare-kv REQ id into the number 31110 would collide against a shipped US-31110; band headroom (31109-31899) leaves that space.
+
+ADR/TAC suffixes for this blueprint use the 3201-3299 block, continuing the shelf pattern.
+
+## Shared expectations for future composing blueprints
+
+- Reuse `keyValueStoreContract` exactly as spelled here when your blueprint holds an opinion on the key-value-store contract at the facade boundary; contribute your own scope:global ADR on that string and let composition surface the pairing.
+- A future non-KV adapter (a Redis-shape store, a strong-consistency Durable Objects cell for a single-owner use case) mints on demand; each claims `keyValueStoreContract` and conflicts by design.
+- Consumer blueprints reading the `keyValueStore` capability declared on `blueprint.json` per section 6a of `blueprint-authoring.md` obtain the facade at apply time via the T-5 visual-round capability-declaration mechanism.
+
+## Deliberate-conflict statement
+
+This blueprint's ADR-3201 on `keyValueStoreContract` is a first shipped answer to a topic that will conflict, by design, with a future non-KV adapter sibling. Applying `platform-cloudflare-kv` alongside such a sibling would raise one `globalAdrTopic` conflict the operator resolves via one of the four documented resolutions per topic (adopt one, keep the existing one, author a project-level supersede ADR, or `--resolve <topic>=project:<ADR-id>` on the add).

package/blueprints/platform-cloudflare-kv/guide/platform-cloudflare-kv.md

@@ -0,0 +1,138 @@
+# platform-cloudflare-kv: the shipped shape
+
+This guide is the two-to-three-screen orientation for a developer
+about to apply `platform-cloudflare-kv` on a Cloudflare Workers
+project. It complements the README (interface reference) and the
+CHANGELOG (version history).
+
+## When to reach for KV
+
+Cloudflare Workers KV is a global, low-latency key-value store
+(<https://developers.cloudflare.com/kv/>). It is the shipped answer
+for:
+
+- Feature flags and small configuration blobs read from every edge
+  request.
+- Session or token caches where a per-request read latency matters
+  more than the write-appearing-instantly-everywhere guarantee.
+- Read-through caches over a slower origin (a database, a downstream
+  API) where a 60-second staleness ceiling is acceptable.
+
+KV is NOT the shipped answer when:
+
+- Every read must reflect the most recent write (KV is eventually
+  consistent).
+- A single key must have one authoritative owner across the fleet
+  (needs a coordinator, not a global cache).
+- The value is mutated by concurrent writers who each expect their
+  write to win in a total order.
+
+Those three cases point at Durable Objects: the round-6 T-3 sibling
+`platform-cloudflare-durable-objects` is the shipped answer for
+strong-consistency needs.
+
+## The eventual-consistency note
+
+Workers KV is documented as eventually consistent
+(<https://developers.cloudflare.com/kv/concepts/how-kv-works/>). Two
+practical consequences the guide surfaces:
+
+1. A write made in one Cloudflare location is usually immediately
+   visible on a same-location read, but not guaranteed to be. On a
+   different location, changes may take up to 60 seconds or more to
+   be visible as cached versions time out.
+2. Negative lookups (indicating a key does not exist) are also
+   cached, creating similar delays when discovering newly created
+   values.
+
+The elicited cache-aside TTL (default 60 seconds per ADR-3202)
+aligns the cache-aside staleness ceiling with the Cloudflare cache
+TTL default so two clocks are one clock. A project that needs
+tighter staleness re-elicits with a smaller TTL; a project that
+needs looser staleness re-elicits with a larger TTL. The TTL floor
+(1 second) is enforced by the cache-aside helper so a misconfigured
+project cannot ship a sub-second TTL.
+
+## Decision tree: KV, Durable Objects, or something else
+
+- Reads dominate writes AND a global staleness ceiling of a few
+  seconds is acceptable AND writes come from few writers -> `platform-cloudflare-kv`.
+- Reads mix with writes AND every read must reflect the most recent
+  write AND one key has one authoritative owner -> `platform-cloudflare-durable-objects` (round-6 T-3).
+- Row-shaped relational data with SQL semantics ->
+  `persistence-data-postgres` or `persistence-data-d1` (via
+  `persistenceStore`).
+- Large binary uploads or reports -> `object-storage-s3` (via
+  `objectStorage`).
+
+## Applying the blueprint
+
+1. Answer the elicited prompts at apply time:
+   - `kv-binding-name`: the binding name the Worker sees on `env`.
+     Default `CACHE`.
+   - `kv-default-cache-ttl-seconds`: the cache-aside default TTL.
+     Default `60`, floor `1`, no upper ceiling imposed by the
+     helper.
+   - `kv-metadata-field-pattern`: recommended default `{v: number}`
+     for a per-key schema version marker.
+   - `kv-key-naming-convention`: `prefixed` (recommended) or
+     `flat` per ADR-3203.
+
+2. Create a KV namespace via `wrangler`:
+
+   ```
+   npx wrangler kv namespace create <kv-binding-name>
+   ```
+
+   Copy the returned `id` and `preview_id` into
+   `wrangler.toml` under `[[kv_namespaces]]`; the shipped fixture
+   uses placeholder ids so `wrangler dev` boots without a live
+   namespace.
+
+3. Import the facade at your app boundary; construct once, pass
+   into request handlers:
+
+   ```js
+   import { createKvFacade } from './src/kv-facade.mjs';
+   import { createCacheAside } from './src/cache-aside.mjs';
+
+   const facade = createKvFacade({
+     binding: env.CACHE,
+     eventSink: emit,
+     defaultCacheTtl: 60,
+   });
+   const cache = createCacheAside({ facade, defaultTtl: 60 });
+   ```
+
+4. Consume the typed verbs:
+
+   ```js
+   const cached = await cache.getOr('flags/feature-1', async () => {
+     const fresh = await fetchFromOrigin();
+     return fresh;
+   });
+   ```
+
+## The event-sink boundary
+
+Every KV operation emits a metadata-only lifecycle event on the
+injected sink: `facadeReady`, `kvHit`, `kvMiss`, `kvWrite`. Each
+record carries EXACTLY `{event, key, size, ttl, timestamp}` and
+nothing else: no body bytes, no metadata pass-through, no user id
+beyond the key itself. The event-secrecy probe drives this at
+mechanism reach with a PII fixture body; the shipped facade passes
+cleanly and a mutation-run under `SIMULATE_PII_LEAK` trips the
+probe to fail.
+
+Wire the sink into the applied logging companion (`observability-
+logging`) so the events render into the log stream without a body
+byte ever leaving the facade.
+
+## Standards references
+
+- <https://developers.cloudflare.com/kv/> (Workers KV overview)
+- <https://developers.cloudflare.com/kv/api/> (binding API)
+- <https://developers.cloudflare.com/kv/concepts/how-kv-works/>
+  (consistency model, default cache TTL)
+- <https://developers.cloudflare.com/kv/platform/limits/> (documented
+  per-namespace limits, the vendor ceiling above the shipped TTL)

package/blueprints/platform-docker-compose-host/CHANGELOG.md

@@ -0,0 +1,12 @@
+# platform-docker-compose-host CHANGELOG
+
+## 1.0.0 - 2026-09-08
+
+Initial release. Round-7 T-2 of the Hetzner spec at `projects/blueprint-library/specs/hetzner-round-7-spec-2026-09-07.md`.
+
+- Mints capability `containerHost` and global topic `containerHostContract`.
+- Six REQs, nine USs, four TACs, four ADRs; five Node-only probes.
+- Extends the shared throwaway-Hetzner-server fixture with a minimal compose stack (`compose.yaml`, `caddy/Caddyfile`, `secrets/web-token` file mount, `src/serve.mjs` healthchecked stub) plus five `run-<probe>.mjs` delegate shims.
+- Compose-config-lint carries four mutation switches (`SIMULATE_MISSING_HEALTHCHECK`, `SIMULATE_UNCLASSIFIED_RESTART`, `SIMULATE_UNCLASSIFIED_LOG_DRIVER`, `SIMULATE_EVENT_SECRECY_LEAK`); secrets-as-files-scan carries `SIMULATE_PLAINTEXT_SECRET`; caddyfile-validate carries `SIMULATE_INVALID_CADDYFILE` and runs `caddy validate` via the `caddy:2` container when a local `caddy` binary is not on PATH.
+- Reverse-proxy choice elicited via `reverse-proxy` (caddy default per Baz decision 19; traefik and none alternatives); Coolify rejected verbatim per Baz decision 20; log driver elicited via `log-driver` (journald default; loki opt-in).
+- Consumers: `w-2026-09-07-dave-004` migrates the ops-01 remote-library compose stack onto this contract after 0.25.0 ships; blueprint acceptance never depends on that migration.

package/blueprints/platform-docker-compose-host/README.md

@@ -0,0 +1,76 @@
+# platform-docker-compose-host v1.0.0
+
+A container-orchestration facade over docker compose running on a Linux `cloudHost`. Provides `containerHost` for consumer blueprints that ship as containers.
+
+## What it commits
+
+Six REQs, nine USs, four TACs, four ADRs and five Node-only probes. Round-7 T-2 of the Hetzner spec at `projects/blueprint-library/specs/hetzner-round-7-spec-2026-09-07.md`.
+
+| REQ | Contract |
+|---|---|
+| REQ-001 | `compose.yaml` at repo root is the single-source runtime topology (service-per-container, named networks and volumes, `.env` for non-secret config) |
+| REQ-002 | Every secret injected via a docker compose secrets file mount; no plaintext literal in `compose.yaml` (grep-refuse); references `security-secrets-management` when applied |
+| REQ-003 | Healthcheck contract on every HTTP-terminating service; `docker compose config` refuses on missing |
+| REQ-004 | Restart discipline enforced at lint: `unless-stopped` on long-running, `on-failure` on jobs; unclassified value refuses |
+| REQ-005 | Zero-downtime reverse-proxy reload via bind-mounted config; verb per proxy; no non-2xx or dropped connection inside the elicited window (10 s default) |
+| REQ-006 | Log shipping to the elicited `observability-logging` sink: `journald` default matching Debian 12 / Ubuntu 24.04 baseline; `loki` opt-in when the project runs Grafana |
+
+## Capability
+
+- `containerHost` (extends `blueprint-authoring.md` section 6a).
+
+## Suggested companions
+
+- `logging`: every `composeStackReady`, `containerHealthy`, `containerCrashed` and `reverseProxyReloaded` event writes through the applied logger; a logging companion supplies the factory and the log-driver binding.
+- `errorHandling`: a healthcheck timeout, a compose lint refusal, a secret-file-mode mismatch, a reload window overshoot constructs an internal error record; an error-handling companion supplies the record factory and the boundary.
+
+## Elicits (via `elicits[]`)
+
+- `reverse-proxy`: `caddy` (default per Baz decision 19, matches dev-01 and ops-01) | `traefik` (alternative for docker-label auto-discovery) | `none` (alternative for projects fronted only by the round-7 tunnel).
+- `docker-engine-channel`: `stable` (default) | `test`.
+- `compose-file-location`: `repo-root` (default) | `compose/compose.yaml`.
+- `healthcheck-default-kind`: `http` (default) | `tcp` | `command`.
+- `log-driver`: `journald` (default per ADR-3904) | `loki` (opt-in).
+- `reload-window-seconds`: default `10`.
+
+## ADR shape
+
+- ADR-3901 container host contract: scope `global` on new topic `containerHostContract`; standards trace clause `Docker Compose file reference AND Docker Engine install-on-Ubuntu docs per hetzner-round-7-spec-2026-09-07.md`.
+- ADR-3902 reverse proxy: elicited, `caddy` default; standards trace clause `Caddy docs AND Traefik docs per hetzner-round-7-spec-2026-09-07.md`.
+- ADR-3903 reject Coolify: decision quoted verbatim from Baz ruling 20 ("reject; it shadows what the blueprints contract and adds its own DB and UI as a second source of state"); standards trace clause `generic enterprise practice`.
+- ADR-3904 log driver: elicited, `journald` default; standards trace clause `generic enterprise practice`.
+
+## Probes
+
+Five modules under `contributions/probes/`, each writes an envelope to `.rcf/reports/blueprints/platform-docker-compose-host/<probe>.json`:
+
+- `compose-config-lint` (accountBound: false; anchors AC-composeHost-healthcheckLint, AC-composeHost-restartClassification, AC-composeHost-logDriverClassification). Mutations: `SIMULATE_MISSING_HEALTHCHECK`, `SIMULATE_UNCLASSIFIED_RESTART`, `SIMULATE_UNCLASSIFIED_LOG_DRIVER`, `SIMULATE_EVENT_SECRECY_LEAK`.
+- `secrets-as-files-scan` (accountBound: false; anchors AC-composeHost-secretsAreFiles, AC-composeHost-secretShape). Mutation: `SIMULATE_PLAINTEXT_SECRET`.
+- `caddyfile-validate` (accountBound: false; anchors AC-composeHost-reverseProxyArtefactValid). Runs a local `caddy` binary when present, otherwise the `caddy:2` container via `docker run --rm`. Mutation: `SIMULATE_INVALID_CADDYFILE`. Skipped when `REVERSE_PROXY` is not `caddy`.
+- `real-account-minimal-stack-up` (accountBound: true; anchors AC-composeHost-upClean). Provisions the throwaway server, `scp`s the compose stack, runs `docker compose up -d --wait`, asserts every declared service reaches healthy inside the elicited timeout, tears down in `always()`. Records `accountBoundSkipped: true` without `CI_HAS_HETZNER_ACCOUNT`.
+- `real-account-reload-burst` (accountBound: true; anchors AC-composeHost-zeroDowntimeReload). Fires an `undici` burst against the caddy service while `docker compose exec caddy caddy reload` runs, asserts every request returns 2xx inside the elicited window with no dropped connection, tears down in `always()`. Records `accountBoundSkipped: true` without `CI_HAS_HETZNER_ACCOUNT`.
+
+## Running the probes
+
+From the shared throwaway-server fixture directory:
+
+```
+cd packages/rcf-lite/test/fixtures/hetzner-throwaway-server
+node ./run-compose-config-lint.mjs && node ./run-secrets-as-files-scan.mjs && node ./run-caddyfile-validate.mjs
+```
+
+Real-account probes gate on `CI_HAS_HETZNER_ACCOUNT`:
+
+```
+cd packages/rcf-lite/test/fixtures/hetzner-throwaway-server
+CI_HAS_HETZNER_ACCOUNT=true HCLOUD_TOKEN=$HETZNER_ACCOUNT_API_KEY node ./run-real-account-minimal-stack-up.mjs && node ./run-real-account-reload-burst.mjs
+```
+
+## Fixture extension path
+
+Round-7 T-1 (`deploy-hetzner-server`) minted the shared fixture at `packages/rcf-lite/test/fixtures/hetzner-throwaway-server/`. T-2 EXTENDS that fixture, never duplicates it: `compose.yaml`, `caddy/Caddyfile`, `secrets/web-token`, `src/serve.mjs` and five `run-<probe>.mjs` delegate shims land alongside T-1's `provision.mjs`/`destroy.mjs`/`sweep-orphans.mjs`. T-3 (`edge-cloudflare-tunnel`) extends the same fixture further; consumers of that fixture see one folder, one manifest, three tracks worth of runtime.
+
+## When to reach for this blueprint
+
+- Any project running a containerised stack on a `cloudHost` (T-1 `deploy-hetzner-server` provides the shipped v1.0.0 provider).
+- Any project that wants secrets as file mounts (not environment literals), healthchecks that gate boot, a checked-in reverse-proxy artefact, and a log driver on the elicited sink.