rcf-lite 0.23.0 → 0.25.0

package/blueprints/platform-docker-compose-host/contributions/user-stories/platform-docker-compose-host-us-38101.json

@@ -0,0 +1,24 @@
+{
+  "usId": "platform-docker-compose-host-US-38101",
+  "prdId": "PRD-001",
+  "reqId": "platform-docker-compose-host-REQ-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "compose.yaml at repo root is the single-source runtime topology (service-per-container, named networks and volumes, .env for non-secret config)",
+  "asA": "shelf consumer applying the platform-docker-compose-host v1.0.0 blueprint on a project that runs its stack on a Hetzner cloudHost",
+  "iWant": "a single compose.yaml at the repo root to declare every service as one container with explicit named networks, named volumes, and non-secret config in a .env file",
+  "soThat": "the runtime topology has one auditable seam and the container host can bring the stack up from the file alone",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-composeHost-topologyValid",
+      "description": "The applied compose.yaml at the repo root declares (a) every entry under services: as exactly one image running one container, (b) at least one named network under top-level networks:, (c) at least one named volume under top-level volumes:, and (d) non-secret configuration values are loaded from a colocated .env file rather than inlined as service environment entries.",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-3901-platform-docker-compose-host-compose-layout"
+  ],
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/platform-docker-compose-host/contributions/user-stories/platform-docker-compose-host-us-38102.json

@@ -0,0 +1,24 @@
+{
+  "usId": "platform-docker-compose-host-US-38102",
+  "prdId": "PRD-001",
+  "reqId": "platform-docker-compose-host-REQ-002",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "secrets flow via docker compose secrets file mounts, no plaintext literal in compose.yaml",
+  "asA": "shelf consumer applying the platform-docker-compose-host v1.0.0 blueprint on a project with secret material bound to a container",
+  "iWant": "every secret to be declared under the compose secrets top-level key and mounted into the service via secrets: rather than inlined as an environment literal",
+  "soThat": "the compose file is safe to read at review time and the mounted file inherits 0o400 inside the container",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-composeHost-secretShape",
+      "description": "The applied compose.yaml declares at least one secret under the top-level secrets: key with a file: source and references it from the consuming service through the service-level secrets: array. The mounted secret file lands at mode 0o400 inside the container.",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-3902-platform-docker-compose-host-secrets-mount"
+  ],
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/platform-docker-compose-host/contributions/user-stories/platform-docker-compose-host-us-38103.json

@@ -0,0 +1,24 @@
+{
+  "usId": "platform-docker-compose-host-US-38103",
+  "prdId": "PRD-001",
+  "reqId": "platform-docker-compose-host-REQ-002",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "the secrets-as-files probe refuses any plaintext secret literal in compose.yaml or a referenced service config",
+  "asA": "shelf consumer applying the platform-docker-compose-host v1.0.0 blueprint on a project with sensitive material",
+  "iWant": "the secrets-as-files probe to walk compose.yaml and every referenced service config in the fixture and refuse on any plaintext secret literal, naming the file and line",
+  "soThat": "a secret accidentally inlined in a review is caught by the probe before docker compose up runs",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-composeHost-secretsAreFiles",
+      "description": "The secrets-as-files-scan probe walks compose.yaml plus every referenced service config file in the applied fixture and asserts (a) no line contains the applied plaintext token pattern (literal name plus literal value), (b) every declared secret in the compose secrets: key has a file: source, and (c) SIMULATE_PLAINTEXT_SECRET=true writes a plaintext literal into compose.yaml and the probe FAILS naming the file and the literal.",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-3902-platform-docker-compose-host-secrets-mount"
+  ],
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/platform-docker-compose-host/contributions/user-stories/platform-docker-compose-host-us-38104.json

@@ -0,0 +1,24 @@
+{
+  "usId": "platform-docker-compose-host-US-38104",
+  "prdId": "PRD-001",
+  "reqId": "platform-docker-compose-host-REQ-003",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "healthcheck contract enforced by docker compose config: refuses on any HTTP-terminating service missing a healthcheck block",
+  "asA": "shelf consumer applying the platform-docker-compose-host v1.0.0 blueprint on a project that terminates HTTP inside a container",
+  "iWant": "the compose-config-lint to refuse at gate time on any HTTP-terminating service that is missing a healthcheck block, naming the service",
+  "soThat": "the stack never comes up with a service the container host cannot know is ready",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-composeHost-healthcheckLint",
+      "description": "The compose-config-lint probe shells to docker compose config against the applied compose.yaml, asserts exit 0, and additionally asserts every HTTP-terminating service declares a healthcheck: block. SIMULATE_MISSING_HEALTHCHECK=true strips the block from the web service and the probe FAILS naming the service.",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-3903-platform-docker-compose-host-healthcheck-lint"
+  ],
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/platform-docker-compose-host/contributions/user-stories/platform-docker-compose-host-us-38105.json

@@ -0,0 +1,25 @@
+{
+  "usId": "platform-docker-compose-host-US-38105",
+  "prdId": "PRD-001",
+  "reqId": "platform-docker-compose-host-REQ-003",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "the minimal stack comes up clean and every declared service reaches healthy on the throwaway server",
+  "asA": "shelf consumer applying the platform-docker-compose-host v1.0.0 blueprint on a Hetzner cloudHost",
+  "iWant": "the real-account minimal-stack-up probe to scp the compose.yaml to the throwaway server, run docker compose up -d --wait, and assert every declared service reaches healthy inside the elicited timeout",
+  "soThat": "the composeStackReady claim is proven on real docker before the blueprint ships",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-composeHost-upClean",
+      "description": "The real-account-minimal-stack-up probe, when CI_HAS_HETZNER_ACCOUNT is set, scps the compose.yaml to the throwaway server, runs docker compose up -d --wait, asserts every declared service reaches healthy inside the elicited timeout, and tears the stack plus the server down in always(). Without CI_HAS_HETZNER_ACCOUNT the probe records accountBoundSkipped: true and the aggregate flips to pass.",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-3901-platform-docker-compose-host-compose-layout",
+    "TAC-3903-platform-docker-compose-host-healthcheck-lint"
+  ],
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/platform-docker-compose-host/contributions/user-stories/platform-docker-compose-host-us-38106.json

@@ -0,0 +1,24 @@
+{
+  "usId": "platform-docker-compose-host-US-38106",
+  "prdId": "PRD-001",
+  "reqId": "platform-docker-compose-host-REQ-004",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "restart discipline enforced at lint: unless-stopped or on-failure only",
+  "asA": "shelf consumer applying the platform-docker-compose-host v1.0.0 blueprint",
+  "iWant": "the compose-config-lint to enforce a restart policy on every service and refuse on any value outside the two allowed policies (unless-stopped for long-running, on-failure for jobs)",
+  "soThat": "the operator sees a wrong or missing restart policy at gate time rather than as a stuck container",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-composeHost-restartClassification",
+      "description": "The compose-config-lint probe asserts every service in the compose.yaml declares a restart policy AND every declared value is one of unless-stopped or on-failure. SIMULATE_UNCLASSIFIED_RESTART=true sets restart: always on the web service and the probe FAILS naming the service and the disallowed value.",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-3903-platform-docker-compose-host-healthcheck-lint"
+  ],
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/platform-docker-compose-host/contributions/user-stories/platform-docker-compose-host-us-38107.json

@@ -0,0 +1,24 @@
+{
+  "usId": "platform-docker-compose-host-US-38107",
+  "prdId": "PRD-001",
+  "reqId": "platform-docker-compose-host-REQ-005",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "reverse-proxy config is a first-class versioned artefact validated by the vendor validator",
+  "asA": "shelf consumer applying the platform-docker-compose-host v1.0.0 blueprint with reverseProxy=caddy",
+  "iWant": "a checked-in caddy/Caddyfile bind-mounted into the proxy service so the reload verb picks up an operator change, validated at gate time by caddy validate",
+  "soThat": "a broken Caddyfile is caught before the reload burst runs, and there is one place in the tree the operator edits to route hostnames",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-composeHost-reverseProxyArtefactValid",
+      "description": "The applied fixture ships caddy/Caddyfile under a caddy/ directory, the compose file bind-mounts it read-only into the caddy service, and the caddyfile-validate probe shells to caddy validate against the file (using the caddy:2 container image when a local caddy binary is not on PATH) and asserts exit 0. SIMULATE_INVALID_CADDYFILE=true writes an invalid directive and the probe FAILS naming the line. Skipped when the applied reverseProxy is not caddy.",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-3904-platform-docker-compose-host-reverse-proxy-artefact"
+  ],
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/platform-docker-compose-host/contributions/user-stories/platform-docker-compose-host-us-38108.json

@@ -0,0 +1,24 @@
+{
+  "usId": "platform-docker-compose-host-US-38108",
+  "prdId": "PRD-001",
+  "reqId": "platform-docker-compose-host-REQ-005",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "zero-downtime reverse-proxy reload: a client burst inside the elicited window sees no non-2xx and no dropped connection",
+  "asA": "shelf consumer applying the platform-docker-compose-host v1.0.0 blueprint",
+  "iWant": "the real-account reload-burst probe to fire an undici burst against the reverse proxy while docker compose exec caddy caddy reload runs and assert no non-2xx or dropped connection inside the elicited window",
+  "soThat": "the zeroDowntimeReload claim is proven on real docker before the blueprint ships",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-composeHost-zeroDowntimeReload",
+      "description": "The real-account-reload-burst probe, when CI_HAS_HETZNER_ACCOUNT is set, runs undici GETs against the proxy service on the throwaway server while docker compose exec caddy caddy reload runs, asserts every request returns a 2xx status inside the elicited window (10 s default), asserts no dropped connection, and tears the stack down in always(). Without CI_HAS_HETZNER_ACCOUNT the probe records accountBoundSkipped: true and the aggregate flips to pass.",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-3904-platform-docker-compose-host-reverse-proxy-artefact"
+  ],
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/platform-docker-compose-host/contributions/user-stories/platform-docker-compose-host-us-38109.json

@@ -0,0 +1,24 @@
+{
+  "usId": "platform-docker-compose-host-US-38109",
+  "prdId": "PRD-001",
+  "reqId": "platform-docker-compose-host-REQ-006",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "log shipping to the elicited observability-logging sink: every service declares a logging driver in the allowed set",
+  "asA": "shelf consumer applying the platform-docker-compose-host v1.0.0 blueprint on a project that may run Grafana or the estate default",
+  "iWant": "the elicited log driver to be wired into every service in the compose file (journald default, loki opt-in) and the choice recorded on the log-driver ADR",
+  "soThat": "container stdout and stderr reach the applied observability sink without a per-service edit",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-composeHost-logDriverClassification",
+      "description": "Every service in the applied compose.yaml declares a logging: driver: block whose driver value matches the elicited log driver (default journald). The compose-config-lint probe asserts (a) every service declares logging: driver, (b) the value is one of journald or loki, and (c) SIMULATE_UNCLASSIFIED_LOG_DRIVER=true sets a disallowed driver and the probe FAILS naming the service and the disallowed value.",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-3903-platform-docker-compose-host-healthcheck-lint"
+  ],
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/platform-docker-compose-host/docs/topics.md

@@ -0,0 +1,71 @@
+# platform-docker-compose-host blueprint coordination vocabulary
+
+This file is the platform-docker-compose-host half of the cross-blueprint contract. The Phase 1 conflict detector matches scope:global ADR topics by EXACT string equality, and AC ids are unnamespaced by the 0.4.4 grammar. Any blueprint intended to compose with this one must reuse these exact strings and respect these bands.
+
+## Global ADR topics this blueprint contributes (exact strings)
+
+| Topic string | platform-docker-compose-host contribution | Origin | Composition note |
+|---|---|---|---|
+| `containerHostContract` | ADR-3901-platform-docker-compose-host-contract | Minted by this blueprint. Names the wire-shape contract for the project-wide container-orchestration surface running on a `cloudHost`; the shipped answer is docker compose as source of truth (compose.yaml at repo root; healthchecks required; secrets as file mounts; restart discipline unless-stopped or on-failure; reverse-proxy config as a first-class checked-in artefact) per `https://docs.docker.com/reference/compose-file/` and `https://docs.docker.com/engine/install/ubuntu/`. | The one project-wide decision on how services are declared, wired and brought up on a container-orchestration surface. A future non-compose sibling (Docker Swarm, Nomad) would contribute the same topic string with a different mechanism, forcing a DELIBERATE conflict the operator resolves with a project-level ADR. |
+
+The platform-docker-compose-host blueprint claims one global topic (minted here, shipped as the docker compose file contract on a Linux `cloudHost`). ADR-3902 reverse-proxy elicit, ADR-3903 reject Coolify and ADR-3904 log-driver elicit do not contribute global topics; a composing blueprint that holds an opinion on either authors its own project-level ADR.
+
+Rules for new topics: lower camel case, one concept per topic, no version suffixes. A topic names the decision area, not the chosen answer.
+
+## Id number bands (registry bootstrap)
+
+This table is maintained shelf-wide across every blueprint's `docs/topics.md`. Rows are recorded at ship, never predicted.
+
+| Blueprint | US band | ADR/TAC suffix block | Status | Global topics |
+|---|---|---|---|---|
+| application-spa | 1101-1899 | 2xx | shipped v1.3.0 | `clientRouting`, `theming`, `clientState`, `errorEnvelope`, `authModel` |
+| application-api-rest | 2101-2899 | 3xx | shipped v1.0.0 | `errorEnvelope`, `authModel`, `apiVersioning`, `logging` |
+| security-auth-magic-link | 3101-3899 | 5xx | shipped v1.2.0 | `authModel` |
+| email-smtp-resend | 4101-4899 | 4xx | shipped v1.0.0 | none |
+| hello-panel (walkthrough exemplar) | 4101-4899 | 4xx | doc-reserved; teaching exemplar in `packages/rcf-lite/docs/blueprint-authoring-walkthrough.md`, not shipped as a blueprint directory | `operatorPanel` |
+| persistence-data-sqlite | 5101-5899 | 6xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
+| delivery-ci-workflows | 6101-6899 | 7xx | shipped v2.0.0 (renamed from ci-pipeline) | `ciGates`, `strictCoverageGate`, `releaseArtefacts` |
+| observability-essentials | 7101-7899 | 8xx | shipped v2.0.0 | `statusPageContract` |
+| security-secrets-management | 8101-8899 | 9xx | shipped v1.0.1 | `secretsSource` |
+| security-auth-clerk | 9101-9899 | 10xx | shipped v1.0.0 | `authModel` |
+| security-auth-oauth2 | 10101-10899 | 11xx | shipped v1.0.0 | `authModel` |
+| security-auth-keycloak | 11101-11899 | 12xx | shipped v1.0.0 | `authModel` |
+| deploy-cloudflare-workers | 12101-12899 | 13xx | shipped v1.2.0 | `deploymentTarget` |
+| persistence-data-d1 | 13101-13899 | 14xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
+| observability-probe-endpoints | 14101-14899 | 15xx | shipped v1.1.0 | `healthProbes`, `readinessSemantics` |
+| observability-logging | 15101-15899 | 16xx | shipped v1.0.0 | `logging` |
+| application-error-handling | 16101-16899 | 17xx | shipped v1.0.0 | `errorHandling` |
+| application-datatable | 17101-17899 | 18xx | shipped v1.0.0 | none |
+| application-charts | 18101-18899 | 19xx | shipped v1.0.0 | none |
+| application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
+| application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
+| application-admin-console | 21101-21899 | 22xx | shipped v1.1.0 | `adminConsoleSignInSurface` |
+| application-empty-error-states | 22101-22899 | 23xx | shipped v1.0.0 | none |
+| application-file-upload | 23101-23899 | 24xx | shipped v1.0.0 | none |
+| application-forms-wizard | 24101-24899 | 25xx | shipped v1.0.0 | none |
+| application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
+| application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
+| persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
+| jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
+| platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |
+| platform-cloudflare-cron-triggers | 32101-32899 | 33xx | shipped v1.0.0 | `scheduledTriggerContract` |
+| platform-cloudflare-durable-objects | 33101-33899 | 34xx | shipped v1.0.0 | `strongConsistencyCellContract`, `websocketHubContract` |
+| edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
+| edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
+| edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
+| deploy-hetzner-server | 37101-37899 | 38xx | shipped v1.0.0 | `linuxCloudHostContract`, `snapshotAndBackupCadence` |
+| platform-docker-compose-host | 38101-38899 | 39xx | shipped v1.0.0 | `containerHostContract` |
+| edge-cloudflare-tunnel | 39101-39899 | 40xx | shipped v1.0.0 | `edgeIngressBridge` |
+
+US 38101-38109 sit at the LOW end of the 38101-38899 band on purpose (watchpost run-4 lesson). A project-side story mechanically derived from a platform-docker-compose-host REQ id into the number 38109 would collide against the shipped US-38109; band headroom (38110-38899) leaves that space.
+
+Platform-docker-compose-host suffixes for this blueprint use the 3901-3904 block, continuing the widening pattern (deploy-hetzner-server 3801-3804 for the T-1 sibling).
+
+## Cross-references
+
+- `deploy-hetzner-server` (v1.0.0): consumed via `capabilities: [cloudHost]`; this blueprint composes on the Hetzner cloudHost T-1 provisions.
+- `security-secrets-management` (v1.0.1): the compose secrets file source resolves through the applied secrets facade when the secrets blueprint is applied; the guide names a file-based fallback path when it is not.
+- Round-7 T-3 `edge-cloudflare-tunnel`: composes on `capabilities: [containerHost]`; runs cloudflared as a compose service in this stack.
+- `observability-logging`: elicited log-driver wires the applied logging companion's endpoint (journald by default, loki opt-in).

package/blueprints/platform-docker-compose-host/guide/platform-docker-compose-host.md

@@ -0,0 +1,94 @@
+# Guide: platform-docker-compose-host v1.0.0
+
+Round-7 T-2 of the Hetzner spec at `projects/blueprint-library/specs/hetzner-round-7-spec-2026-09-07.md`. Applies on top of `deploy-hetzner-server` (or any future `cloudHost` provider) and mints `containerHost` for downstream consumers.
+
+## What this blueprint gives you
+
+A docker compose stack as your application runtime on a Linux VM. The compose file is the source of truth for the topology: services, networks, volumes, secrets, healthchecks, restart policy, log driver and the reverse-proxy bind-mount all live in one file at the repo root. Every claim the blueprint makes is provable at gate time by a Node-only probe against a real docker daemon and a real reverse-proxy config.
+
+## Layout
+
+```
+<repo-root>/
+  compose.yaml            # single-source topology per REQ-001
+  .env                    # non-secret config per REQ-001
+  caddy/
+    Caddyfile             # reverse-proxy artefact per REQ-005 (when reverseProxy=caddy)
+  secrets/
+    <name>                # file-mount source per REQ-002 (0o400 inside the container)
+  src/
+    ...                   # your service code, bind-mounted into services
+```
+
+## When to reach for Caddy vs Traefik vs none
+
+The `reverse-proxy` elicit is the one you will hit first. The defaults:
+
+- **`caddy` (default per Baz decision 19).** Matches the estate baseline (dev-01 and ops-01 both run Caddy). Small config file, automatic HTTPS in production, `docker compose exec caddy caddy reload` picks up changes instantly. Reach for it whenever you do not have a strong project-side reason for something else. See the Caddy docs at https://caddyserver.com/docs/.
+- **`traefik` (alternative).** Reach for it when your project wants docker-label auto-discovery (each service declares its hostname/route via labels in `compose.yaml` and Traefik configures itself). Trade-off: your routing is spread across many service blocks rather than one Caddyfile. See the Traefik docs at https://doc.traefik.io/traefik/.
+- **`none` (alternative).** Reach for it when the project is fronted only by the round-7 tunnel (`edge-cloudflare-tunnel` v1.0.0). The connector terminates at the CF edge and forwards to a service on the internal `web-net` network; no reverse proxy is needed inside compose. The lint refuses to add a `caddy/Caddyfile` when `reverse-proxy` is `none`.
+
+The Coolify note (ADR-3903 body): "reject; it shadows what the blueprints contract and adds its own DB and UI as a second source of state". Baz decision 20, verbatim. A `platform-coolify-host` sibling mints on operator demand later; it is not part of round 7.
+
+## Healthcheck contract
+
+Every HTTP-terminating service declares a `healthcheck:` block. The compose-config-lint probe refuses at `docker compose config` on any missing block, naming the service. Defaults per service kind are elicited:
+
+- `http` (default): a `wget --quiet --spider` against the service's `/health` (or `/live`) path.
+- `tcp`: a socket connect against the declared port.
+- `command`: a bespoke test string the operator supplies.
+
+The stack is not considered up until every declared service reaches healthy inside the elicited timeout; the real-account minimal-stack-up probe proves this on the throwaway server.
+
+## Secrets as files, never literals
+
+Under REQ-002 every secret referenced by any compose service is declared under the top-level `secrets:` key with a `file:` source. Services reference the secret through their service-level `secrets:` array so docker mounts the value at 0o400 inside the container at `/run/secrets/<name>`. The compose file carries no plaintext secret literal (grep-refuse).
+
+When `security-secrets-management` is applied, the source path resolves through that facade. When it is not, the file-based fallback path is: land the secret in `secrets/<name>` on the applying repo under a `.gitignore` line that lists the file, and rotate through the operator's out-of-band vault. Never commit the secret; never inline the value in `compose.yaml` or `.env`.
+
+## When to reach for `journald` vs `loki`
+
+The `log-driver` elicit (ADR-3904):
+
+- **`journald` (default).** Matches the Debian 12 and Ubuntu 24.04 baseline the T-1 cloud-init sets up on the throwaway server. `journalctl -u docker.service` and `journalctl CONTAINER_NAME=<name>` reach the same stream you would see in `docker logs`.
+- **`loki` (opt-in).** Reach for it when the applying project runs Grafana. The compose logging block wires each service through the Grafana Loki docker plugin; the observability-logging companion supplies the loki endpoint.
+
+The compose-config-lint refuses on any driver value outside the two. The lint fires before `docker compose up` runs.
+
+## Restart discipline
+
+Under REQ-004: `restart: unless-stopped` on long-running services, `restart: on-failure` on jobs (short-lived services that exit after completion). Any service that declares neither, or declares a value outside those two, refuses at the lint. `SIMULATE_UNCLASSIFIED_RESTART=true` on the compose-config-lint probe exercises the refusal path.
+
+## Zero-downtime reverse-proxy reload
+
+Under REQ-005 the reverse-proxy config lives as a first-class checked-in artefact under `caddy/Caddyfile` (or `traefik/traefik.yaml`). The compose file bind-mounts it read-only into the proxy service. The reload verb is:
+
+- `docker compose exec caddy caddy reload` for Caddy.
+- `docker compose kill -s USR1 traefik` for Traefik (the documented equivalent).
+
+During the elicited reload window (10 s default per `reload-window-seconds`) a client burst against the proxy sees no non-2xx and no dropped connection. The real-account reload-burst probe proves this on the throwaway server.
+
+## Running the probes
+
+From the shared throwaway-server fixture directory the three local probes run without a Hetzner account:
+
+```
+cd packages/rcf-lite/test/fixtures/hetzner-throwaway-server
+node ./run-compose-config-lint.mjs
+node ./run-secrets-as-files-scan.mjs
+node ./run-caddyfile-validate.mjs
+```
+
+`caddyfile-validate` reaches for a local `caddy` binary when one is on PATH; otherwise it runs `caddy validate` inside the `caddy:2` container via `docker run --rm`. Verify the image once with `docker run --rm caddy:2 caddy version`.
+
+Real-account probes require `CI_HAS_HETZNER_ACCOUNT=true` plus `HCLOUD_TOKEN`; without them each records `accountBoundSkipped: true` and the aggregate flips to `pass` per spec section 3.5.
+
+## Applying to your project
+
+Once T-1 (`deploy-hetzner-server`) has provisioned a `cloudHost`:
+
+```
+rcf apply platform-docker-compose-host
+```
+
+Answer the elicits (reverse-proxy, healthcheck-default-kind, log-driver, reload-window-seconds). The blueprint drops `compose.yaml`, `.env`, `caddy/Caddyfile` (when reverseProxy=caddy), the `secrets/` directory (empty, `.gitignored`) and the READMEs into your applying tree. Then `docker compose up -d --wait` on the applied host brings the stack up.

package/blueprints/security-auth-clerk/docs/topics.md

@@ -39,7 +39,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | application-charts | 18101-18899 | 19xx | shipped v1.0.0 | none |
 | application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
 | application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
-| application-admin-console | 21101-21899 | 22xx | shipped v1.0.0 | none |
+| application-admin-console | 21101-21899 | 22xx | shipped v1.1.0 | `adminConsoleSignInSurface` |
 | application-empty-error-states | 22101-22899 | 23xx | shipped v1.0.0 | none |
 | application-file-upload | 23101-23899 | 24xx | shipped v1.0.0 | none |
 | application-forms-wizard | 24101-24899 | 25xx | shipped v1.0.0 | none |
@@ -49,6 +49,15 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
+| platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |
+| platform-cloudflare-cron-triggers | 32101-32899 | 33xx | shipped v1.0.0 | `scheduledTriggerContract` |
+| platform-cloudflare-durable-objects | 33101-33899 | 34xx | shipped v1.0.0 | `strongConsistencyCellContract`, `websocketHubContract` |
+| edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
+| edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
+| edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
+| deploy-hetzner-server | 37101-37899 | 38xx | shipped v1.0.0 | `linuxCloudHostContract`, `snapshotAndBackupCadence` |
+| platform-docker-compose-host | 38101-38899 | 39xx | shipped v1.0.0 | `containerHostContract` |
+| edge-cloudflare-tunnel | 39101-39899 | 40xx | shipped v1.0.0 | `edgeIngressBridge` |
 
 US 9101-9110 sit at the LOW end of the 9101-9899 band on purpose. A project-side story that mechanically derives from a security-auth-clerk REQ id into the number `9110` would collide against security-auth-clerk-US-9110 in this package; the band leaves headroom at the HIGH end (US 9181-9899) so a project's own stories anchored to security-auth-clerk REQs can allocate without conflict. The watchpost run4 lesson applies here too.
 

package/blueprints/security-auth-keycloak/docs/topics.md

@@ -50,7 +50,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | application-charts | 18101-18899 | 19xx | shipped v1.0.0 | none |
 | application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
 | application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
-| application-admin-console | 21101-21899 | 22xx | shipped v1.0.0 | none |
+| application-admin-console | 21101-21899 | 22xx | shipped v1.1.0 | `adminConsoleSignInSurface` |
 | application-empty-error-states | 22101-22899 | 23xx | shipped v1.0.0 | none |
 | application-file-upload | 23101-23899 | 24xx | shipped v1.0.0 | none |
 | application-forms-wizard | 24101-24899 | 25xx | shipped v1.0.0 | none |
@@ -60,6 +60,15 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
+| platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |
+| platform-cloudflare-cron-triggers | 32101-32899 | 33xx | shipped v1.0.0 | `scheduledTriggerContract` |
+| platform-cloudflare-durable-objects | 33101-33899 | 34xx | shipped v1.0.0 | `strongConsistencyCellContract`, `websocketHubContract` |
+| edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
+| edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
+| edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
+| deploy-hetzner-server | 37101-37899 | 38xx | shipped v1.0.0 | `linuxCloudHostContract`, `snapshotAndBackupCadence` |
+| platform-docker-compose-host | 38101-38899 | 39xx | shipped v1.0.0 | `containerHostContract` |
+| edge-cloudflare-tunnel | 39101-39899 | 40xx | shipped v1.0.0 | `edgeIngressBridge` |
 
 US 11101-11113 sit at the LOW end of the 11101-11899 band on purpose. A project-side story that mechanically derives from a security-auth-keycloak REQ id into the number `11113` would collide against security-auth-keycloak-US-11113 in this package; the band leaves headroom at the HIGH end (US 11181-11899) so a project's own stories anchored to security-auth-keycloak REQs can allocate without conflict. The watchpost run4 lesson applies here too.
 

package/blueprints/security-auth-magic-link/docs/topics.md

@@ -39,7 +39,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | application-charts | 18101-18899 | 19xx | shipped v1.0.0 | none |
 | application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
 | application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
-| application-admin-console | 21101-21899 | 22xx | shipped v1.0.0 | none |
+| application-admin-console | 21101-21899 | 22xx | shipped v1.1.0 | `adminConsoleSignInSurface` |
 | application-empty-error-states | 22101-22899 | 23xx | shipped v1.0.0 | none |
 | application-file-upload | 23101-23899 | 24xx | shipped v1.0.0 | none |
 | application-forms-wizard | 24101-24899 | 25xx | shipped v1.0.0 | none |
@@ -49,6 +49,15 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
+| platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |
+| platform-cloudflare-cron-triggers | 32101-32899 | 33xx | shipped v1.0.0 | `scheduledTriggerContract` |
+| platform-cloudflare-durable-objects | 33101-33899 | 34xx | shipped v1.0.0 | `strongConsistencyCellContract`, `websocketHubContract` |
+| edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
+| edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
+| edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
+| deploy-hetzner-server | 37101-37899 | 38xx | shipped v1.0.0 | `linuxCloudHostContract`, `snapshotAndBackupCadence` |
+| platform-docker-compose-host | 38101-38899 | 39xx | shipped v1.0.0 | `containerHostContract` |
+| edge-cloudflare-tunnel | 39101-39899 | 40xx | shipped v1.0.0 | `edgeIngressBridge` |
 
 US 3101-3111 sit at the LOW end of the 3101-3899 band on purpose. A project-side story that mechanically derives from `security-auth-magic-link-REQ-011` into the number `3111` would collide against security-auth-magic-link-US-3111 in this package; the band leaves headroom at the HIGH end (US 3181-3899) so a project's own stories anchored to security-auth-magic-link REQs can allocate without conflict.
 

package/blueprints/security-auth-oauth2/docs/topics.md

@@ -50,7 +50,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | application-charts | 18101-18899 | 19xx | shipped v1.0.0 | none |
 | application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
 | application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
-| application-admin-console | 21101-21899 | 22xx | shipped v1.0.0 | none |
+| application-admin-console | 21101-21899 | 22xx | shipped v1.1.0 | `adminConsoleSignInSurface` |
 | application-empty-error-states | 22101-22899 | 23xx | shipped v1.0.0 | none |
 | application-file-upload | 23101-23899 | 24xx | shipped v1.0.0 | none |
 | application-forms-wizard | 24101-24899 | 25xx | shipped v1.0.0 | none |
@@ -60,6 +60,15 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
+| platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |
+| platform-cloudflare-cron-triggers | 32101-32899 | 33xx | shipped v1.0.0 | `scheduledTriggerContract` |
+| platform-cloudflare-durable-objects | 33101-33899 | 34xx | shipped v1.0.0 | `strongConsistencyCellContract`, `websocketHubContract` |
+| edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
+| edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
+| edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
+| deploy-hetzner-server | 37101-37899 | 38xx | shipped v1.0.0 | `linuxCloudHostContract`, `snapshotAndBackupCadence` |
+| platform-docker-compose-host | 38101-38899 | 39xx | shipped v1.0.0 | `containerHostContract` |
+| edge-cloudflare-tunnel | 39101-39899 | 40xx | shipped v1.0.0 | `edgeIngressBridge` |
 
 US 10101-10111 sit at the LOW end of the 10101-10899 band on purpose. A project-side story that mechanically derives from a security-auth-oauth2 REQ id into the number `10111` would collide against security-auth-oauth2-US-10111 in this package; the band leaves headroom at the HIGH end (US 10181-10899) so a project's own stories anchored to security-auth-oauth2 REQs can allocate without conflict. The watchpost run4 lesson applies here too.
 

package/blueprints/security-secrets-management/docs/topics.md

@@ -39,7 +39,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | application-charts | 18101-18899 | 19xx | shipped v1.0.0 | none |
 | application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
 | application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
-| application-admin-console | 21101-21899 | 22xx | shipped v1.0.0 | none |
+| application-admin-console | 21101-21899 | 22xx | shipped v1.1.0 | `adminConsoleSignInSurface` |
 | application-empty-error-states | 22101-22899 | 23xx | shipped v1.0.0 | none |
 | application-file-upload | 23101-23899 | 24xx | shipped v1.0.0 | none |
 | application-forms-wizard | 24101-24899 | 25xx | shipped v1.0.0 | none |
@@ -49,6 +49,15 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
+| platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |
+| platform-cloudflare-cron-triggers | 32101-32899 | 33xx | shipped v1.0.0 | `scheduledTriggerContract` |
+| platform-cloudflare-durable-objects | 33101-33899 | 34xx | shipped v1.0.0 | `strongConsistencyCellContract`, `websocketHubContract` |
+| edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
+| edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
+| edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
+| deploy-hetzner-server | 37101-37899 | 38xx | shipped v1.0.0 | `linuxCloudHostContract`, `snapshotAndBackupCadence` |
+| platform-docker-compose-host | 38101-38899 | 39xx | shipped v1.0.0 | `containerHostContract` |
+| edge-cloudflare-tunnel | 39101-39899 | 40xx | shipped v1.0.0 | `edgeIngressBridge` |
 
 US 8101-8110 sit at the LOW end of the 8101-8899 band on purpose. A project-side story that mechanically derives from a security-secrets-management REQ id into the number `8110` would collide against security-secrets-management-US-8110 in this package; the band leaves headroom at the HIGH end (US 8181-8899) so a project's own stories anchored to security-secrets-management REQs can allocate without conflict. The watchpost run4 lesson applies here too.
 

package/fixtures/canary-manifest.json

@@ -1,9 +1,9 @@
 {
   "registerCanary": [
     {
-      "id": "rc-2026-09-07-001",
-      "createdAt": "2026-09-07T11:12:00.498Z",
-      "buildVersion": "0.23.0-mockdriver",
+      "id": "rc-2026-09-08-001",
+      "createdAt": "2026-09-08T05:23:05.136Z",
+      "buildVersion": "0.25.0-mockdriver",
       "fixturePromptId": "canary-prompt-01",
       "responseWordCount": 55,
       "grades": {
@@ -34,9 +34,9 @@
       "shipDespiteFailReason": "mock canary driver used; no real subagent was dispatched. This record verifies canary infrastructure only, not the register itself."
     },
     {
-      "id": "rc-2026-09-07-002",
-      "createdAt": "2026-09-07T11:12:00.499Z",
-      "buildVersion": "0.23.0-mockdriver",
+      "id": "rc-2026-09-08-002",
+      "createdAt": "2026-09-08T05:23:05.137Z",
+      "buildVersion": "0.25.0-mockdriver",
       "fixturePromptId": "canary-prompt-02",
       "responseWordCount": 55,
       "grades": {
@@ -67,9 +67,9 @@
       "shipDespiteFailReason": "mock canary driver used; no real subagent was dispatched. This record verifies canary infrastructure only, not the register itself."
     },
     {
-      "id": "rc-2026-09-07-003",
-      "createdAt": "2026-09-07T11:12:00.499Z",
-      "buildVersion": "0.23.0-mockdriver",
+      "id": "rc-2026-09-08-003",
+      "createdAt": "2026-09-08T05:23:05.137Z",
+      "buildVersion": "0.25.0-mockdriver",
       "fixturePromptId": "canary-prompt-03",
       "responseWordCount": 55,
       "grades": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rcf-lite",
-  "version": "0.23.0",
+  "version": "0.25.0",
   "type": "module",
   "description": "One-install tooling for the Requirements Confidence Framework (RCF): the unified `rcf` CLI grouped into the five RCF tool groups (discover, define, build, verify, audit) plus a small core set (init, doctor, guidance, mcp), an MCP server, the live tree viewer and the fresh-context adversarial ship-gate verifier. Consumes @stravica-ai/rcf-schemas.",
   "license": "Apache-2.0",

package/rcf/adrs/adr-2214-application-admin-console-consume-zero-trust-gate.json

@@ -0,0 +1,13 @@
+{
+  "createdAt": "2026-09-07T16:53:45.591Z",
+  "updatedAt": "2026-09-07T17:03:09.431Z",
+  "adrId": "ADR-2214-application-admin-console-consume-zero-trust-gate",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.1.0",
+  "status": "accepted",
+  "title": "Admin-console reads zeroTrustGate at apply-time and switches sign-in surface (recommendedDefault true)",
+  "context": "application-admin-console v1.0.0 shipped with principalDirectory as the sole hard requirement; sign-in surface was local per whatever security-auth-* was applied. Round-6 T-4 introduces edge-cloudflare-access with the zeroTrustGate capability; a composed deployment needs the admin-console to flip its sign-in surface deterministically.",
+  "decision": "application-admin-console v1.1.0 reads appliedCapabilities via readAppliedCapabilities at apply-time. When zeroTrustGate is present the sign-in surface renders access-gated (no local form, principal reads from request.auth); when absent the surface falls back to whatever security-auth-* is applied. Q4 default (spec 5.4.1): zeroTrustGate is CONSUMED OPTIONALLY; principalDirectory remains the sole hard requirement (making Access-gate hard is a v2.0 change). Standards trace clause: Cloudflare round 6 spec section 5.4 (admin-console v1.1.0 delta). recommendedDefault: true.",
+  "consequences": "The v1.1.0 admin-console remains backward-compatible with every v1.0.0 deployment. An Access-gated deployment automatically stops rendering the local login form; the local-login surface still ships in v1.1.0 (fallback branch when zeroTrustGate absent)."
+}

package/rcf/adrs/adr-3501-edge-cloudflare-access-jwt-gate.json

@@ -0,0 +1,13 @@
+{
+  "createdAt": "2026-09-07T16:53:44.665Z",
+  "updatedAt": "2026-09-07T17:03:08.688Z",
+  "adrId": "ADR-3501-edge-cloudflare-access-jwt-gate",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "accepted",
+  "title": "Edge authentication gate: Cloudflare Access Zero-Trust JWT-assertion gate (scope global, new topic edgeAuthenticationGate)",
+  "context": "T-4 repo-chain ADR mirror for the shipped blueprints/edge-cloudflare-access/contributions/adrs/adr-3501-edge-cloudflare-access-jwt-gate.json contribution. The chain slice is the audit trail for the JWT-gate decision (scope global on new topic edgeAuthenticationGate). Cloudflare Access enforces the Zero-Trust policy at the CF edge and passes a signed JWT to the origin Worker in the Cf-Access-Jwt-Assertion header per https://developers.cloudflare.com/cloudflare-one/policies/access/. Every applied Worker needs one project-wide answer to the edgeAuthenticationGate topic; a future non-Cloudflare adapter conflicts on the same topic by design.",
+  "decision": "The shipped v1.0.0 default is Cloudflare Access's Zero-Trust JWT-assertion gate. The JWT validator (TAC-3501) is the sole reader of the Cf-Access-Jwt-Assertion header and reduces the principal into request.auth. The edgeAuthenticationGate topic scope is global on this blueprint; the topic string is edgeAuthenticationGate (lower camel case). Standards trace clause: Cloudflare Access policy actions and rule selectors.",
+  "consequences": "The applying project inherits Cloudflare's documented Access policy model and the JWT rotation cadence published at https://<team>.cloudflareaccess.com/cdn-cgi/access/certs. Consumers deploying to a non-Cloudflare edge reach for a sibling adapter blueprint that lands as a v1.x minor on this shelf."
+}