rcf-lite 0.23.0 → 0.25.0

package/rcf/adrs/adr-3502-edge-cloudflare-access-identity-provider.json

@@ -0,0 +1,13 @@
+{
+  "createdAt": "2026-09-07T16:53:44.850Z",
+  "updatedAt": "2026-09-07T17:03:08.874Z",
+  "adrId": "ADR-3502-edge-cloudflare-access-identity-provider",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "accepted",
+  "title": "Identity provider for the Access application is elicited (recommendedDefault null)",
+  "context": "Cloudflare Access supports many identity providers (OTP, Google, GitHub, Okta, Entra ID, SAML, OIDC, mTLS); the choice is an enterprise-integration decision.",
+  "decision": "Identity provider is elicited (elicited: true). No recommended default; the applied-sidecar records the operator's answer.",
+  "consequences": "The elicitation forces an explicit operator answer at apply. Standards trace clause: generic enterprise practice."
+}

package/rcf/adrs/adr-3503-edge-cloudflare-access-policy-scope.json

@@ -0,0 +1,13 @@
+{
+  "createdAt": "2026-09-07T16:53:45.034Z",
+  "updatedAt": "2026-09-07T17:03:09.060Z",
+  "adrId": "ADR-3503-edge-cloudflare-access-policy-scope",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "accepted",
+  "title": "Policy scope: application-level (recommended default) or per-path elicited",
+  "context": "Cloudflare Access binds a policy at the application level (one policy protects every path) or per-path. Application-level scope is the most common shape.",
+  "decision": "Recommended default is application-level (recommendedDefault: true); the elicited alternative is per-path. Standards trace clause: Cloudflare Access policy actions and rule selectors.",
+  "consequences": "A fresh project applying the blueprint gets one application-level policy; an operator opting into per-path scope elicits a route table."
+}

package/rcf/adrs/adr-3504-edge-cloudflare-access-audit-retention.json

@@ -0,0 +1,13 @@
+{
+  "createdAt": "2026-09-07T16:53:45.219Z",
+  "updatedAt": "2026-09-07T17:03:09.245Z",
+  "adrId": "ADR-3504-edge-cloudflare-access-audit-retention",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "accepted",
+  "title": "Audit retention window (metadata-only fields) is delegated to the applied logging companion",
+  "context": "The validator emits one audit event per outcome with the metadata-only shape {email, outcome, timestamp, path}. Long-term retention is a compliance decision an applied logging companion already answers.",
+  "decision": "Retention is delegated to the applied logging companion (suggestedCompanions[0]). The blueprint declares no retention policy of its own. Standards trace clause: generic enterprise practice.",
+  "consequences": "A workspace without a logging companion loses the audit events after the Worker context tears down; the guide names the trade."
+}

package/rcf/adrs/adr-3601-edge-cloudflare-turnstile-verifier-contract.json

@@ -0,0 +1,13 @@
+{
+  "createdAt": "2026-09-07T19:56:38.420Z",
+  "updatedAt": "2026-09-07T19:56:38.420Z",
+  "context": "T-5 repo-chain ADR mirror for the shipped blueprints/edge-cloudflare-turnstile/contributions/adrs/adr-3601-edge-cloudflare-turnstile-verifier-contract.json contribution. Cloudflare Turnstile documents a client widget plus a server-side siteverify endpoint (https://challenges.cloudflare.com/turnstile/v0/siteverify) as the wire-shape contract per https://developers.cloudflare.com/turnstile/. Every applied Worker needs one project-wide answer to the humanVerificationGate topic; a future non-Cloudflare adapter (hCaptcha, reCAPTCHA) conflicts on the same topic by design.",
+  "decision": "The shipped v1.0.0 default is Cloudflare Turnstile with server-side siteverify. The verifier POSTs {secret, response} to https://challenges.cloudflare.com/turnstile/v0/siteverify; on success:true the handler proceeds, on success:false the handler rejects 400 with the error-codes value. The humanVerificationGate topic scope is global on this blueprint. Standards trace clause: Cloudflare Turnstile siteverify endpoint documented shape.",
+  "consequences": "The applying project inherits Cloudflare Turnstile documented widget-and-siteverify contract per https://developers.cloudflare.com/turnstile/. A future hCaptcha or reCAPTCHA sibling contributes the same humanVerificationGate topic with a different answer, forcing a deliberate operator-resolved conflict at the project ADR level.",
+  "adrId": "ADR-3601-edge-cloudflare-turnstile-verifier-contract",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "proposed",
+  "title": "Human verification gate: Cloudflare Turnstile siteverify (scope global, new topic humanVerificationGate)"
+}

package/rcf/adrs/adr-3602-edge-cloudflare-turnstile-widget-mode.json

@@ -0,0 +1,13 @@
+{
+  "createdAt": "2026-09-07T19:56:38.606Z",
+  "updatedAt": "2026-09-07T19:56:38.606Z",
+  "context": "Cloudflare Turnstile documents three widget modes per https://developers.cloudflare.com/turnstile/: managed (Cloudflare decides when to show a challenge), non-interactive (always shows a non-interactive challenge) and invisible (mounts an invisible widget). The choice is a per-surface operational profile.",
+  "decision": "Widget mode is elicited (elicited: true). Values: managed, non-interactive, invisible. recommendedDefault: managed. The applied-sidecar records the operator answer per applying surface. Standards trace clause: Cloudflare Turnstile documented widget modes.",
+  "consequences": "The elicitation forces an explicit answer on every apply. The pack fixture accepts mode=managed, non-interactive or invisible and pins the invisible-widget test sitekeys (1x0000000000000000000000BB, 2x0000000000000000000000BB) alongside the managed pass/fail sitekeys so every mode is exercised.",
+  "adrId": "ADR-3602-edge-cloudflare-turnstile-widget-mode",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "proposed",
+  "title": "Widget mode is an elicited enum {managed, non-interactive, invisible}; recommendedDefault managed"
+}

package/rcf/adrs/adr-3603-edge-cloudflare-turnstile-refuse-shape.json

@@ -0,0 +1,13 @@
+{
+  "createdAt": "2026-09-07T19:56:38.789Z",
+  "updatedAt": "2026-09-07T19:56:38.789Z",
+  "context": "Cloudflare Turnstile siteverify returns success:false with error-codes on failure; documented codes at https://developers.cloudflare.com/turnstile/. The applying project needs a stable refusal shape that never leaks the sitekey or the secret.",
+  "decision": "Refuse-if-token-missing status is 400. Refusal body carries a stable error-code (turnstile.token-missing for the guard branch, or the Cloudflare error-codes first entry for the siteverify-failure branch). Refusal body never carries the sitekey, the secret or the response token value. Standards trace clause: Cloudflare Turnstile documented error codes.",
+  "consequences": "The 400 status is machine-observable at every applied surface; downstream observability records the outcome by error-code, not by sitekey. Event records ship sitekeyHash, outcome and timestamp only (event-secrecy probe asserts this).",
+  "adrId": "ADR-3603-edge-cloudflare-turnstile-refuse-shape",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "proposed",
+  "title": "Refuse-if-token-missing status is 400 with an error-code body (no sitekey leak); siteverify failure carries the documented error-codes value"
+}

package/rcf/adrs/adr-3701-edge-cloudflare-rate-limiting-throttle-contract.json

@@ -0,0 +1,13 @@
+{
+  "createdAt": "2026-09-07T21:40:46.232Z",
+  "updatedAt": "2026-09-07T21:40:46.232Z",
+  "context": "T-6 repo-chain ADR mirror for the shipped blueprints/edge-cloudflare-rate-limiting/contributions/adrs/adr-3701-edge-cloudflare-rate-limiting-throttle-contract.json contribution. An applying Workers project needs a zone-level guard that refuses over-threshold bursts at the CF edge before they reach the origin. Cloudflare's WAF rate-limiting rules provide the native answer with a documented rule shape (id, expression, threshold, period, characteristics, action, duration) per https://developers.cloudflare.com/waf/rate-limiting-rules/. Every applied Worker needs one project-wide answer to the edgeThrottleContract topic; a future non-Cloudflare edge-throttle sibling would conflict on the same topic.",
+  "decision": "The shipped v1.0.0 default is Cloudflare WAF rate-limiting rules as the zone-level edge throttle. The rule shape matches the Cloudflare documented fields. The edgeThrottleContract topic scope is global on this blueprint. Standards trace clause: Cloudflare WAF rate-limiting rules documented shape.",
+  "consequences": "The applying project inherits Cloudflare's documented rule shape and platform-imposed limits. Rule state lives on the Cloudflare account, not in the git tree; the local manifest under cloudflare/rate-limits/ is the source of truth. Drift risk is addressed via ADR-3704 (cadence) and TAC-3703 (drift-audit runner).",
+  "adrId": "ADR-3701-edge-cloudflare-rate-limiting-throttle-contract",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "proposed",
+  "title": "Edge throttle contract: Cloudflare WAF rate-limiting rules (scope global, new topic edgeThrottleContract)"
+}

package/rcf/adrs/adr-3702-edge-cloudflare-rate-limiting-layering.json

@@ -0,0 +1,13 @@
+{
+  "createdAt": "2026-09-07T21:40:46.520Z",
+  "updatedAt": "2026-09-07T21:40:46.520Z",
+  "context": "T-6 repo-chain ADR mirror for the shipped blueprints/edge-cloudflare-rate-limiting/contributions/adrs/adr-3702-edge-cloudflare-rate-limiting-layering.json contribution. The security-auth-magic-link blueprint ships a per-email per-minute application-level rate limiter on the mint surface; edge-cloudflare-rate-limiting ships a zone-level IP-per-URL rate rule at the CF edge. Without an explicit layering ADR the operator can mistake the two rules for overlapping.",
+  "decision": "When both blueprints apply, the zone rule sits at the CF edge and refuses the (N+1)th request for the elicited duration before it reaches the origin; the magic-link per-email rate limiter continues at the mint-surface. The two rules operate on different characteristic sets (IP-per-URL vs per-email per-minute) and are additive. recommendedDefault: true. Standards trace clause: generic enterprise practice.",
+  "consequences": "The composition is documented in the guide with a copy-paste example. The applied recorder records both blueprints so the operator sees the two-rule shape at apply time; drift into overlap is caught in the drift-audit runner.",
+  "adrId": "ADR-3702-edge-cloudflare-rate-limiting-layering",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "proposed",
+  "title": "Layering with security-auth-magic-link: zone rule OVER the per-email application rule"
+}

package/rcf/adrs/adr-3703-edge-cloudflare-rate-limiting-manifest-shape.json

@@ -0,0 +1,13 @@
+{
+  "createdAt": "2026-09-07T21:40:46.808Z",
+  "updatedAt": "2026-09-07T21:40:46.808Z",
+  "context": "T-6 repo-chain ADR mirror for the shipped blueprints/edge-cloudflare-rate-limiting/contributions/adrs/adr-3703-edge-cloudflare-rate-limiting-manifest-shape.json contribution. The rule set could be committed as a wrangler-shape script, a bespoke apply tool, a single manifest file, or one file per rule. Single-file hides diff signal when one rule changes; committed script couples the source of truth to a specific tool.",
+  "decision": "The manifest lives at the elicited rate-limit-rules-dir (default cloudflare/rate-limits/), with one JSON file per rule. No committed script writes rules to the live zone; the operator applies through the documented wrangler or dashboard flow per REQ-101 and TAC-3702. recommendedDefault: true. Standards trace clause: generic enterprise practice.",
+  "consequences": "One-file-per-rule keeps each rule diff scoped. No committed apply script means the blueprint does not couple to a tool version and does not require an API token at build time. Operator applies at their chosen cadence; drift risk is addressed via ADR-3704 and TAC-3703.",
+  "adrId": "ADR-3703-edge-cloudflare-rate-limiting-manifest-shape",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "proposed",
+  "title": "Manifest at cloudflare/rate-limits/, one JSON file per rule; operator applies via wrangler or dashboard"
+}

package/rcf/adrs/adr-3704-edge-cloudflare-rate-limiting-drift-audit-cadence.json

@@ -0,0 +1,13 @@
+{
+  "createdAt": "2026-09-07T21:40:47.096Z",
+  "updatedAt": "2026-09-07T21:40:47.096Z",
+  "context": "T-6 repo-chain ADR mirror for the shipped blueprints/edge-cloudflare-rate-limiting/contributions/adrs/adr-3704-edge-cloudflare-rate-limiting-drift-audit-cadence.json contribution. Rate-limit rules live on the Cloudflare account, not in the git tree. Drift in either direction (dashboard change without manifest update, manifest edit without an apply) is only surfaced if the applying project runs the drift-audit runner at a cadence.",
+  "decision": "The drift-audit cadence is elicited (rate-limit-drift-audit-cadence) with three options: off (disables the runner), daily (24-hour cadence), hourly (60-minute cadence). recommendedDefault: daily. elicited: true. Standards trace clause: generic enterprise practice.",
+  "consequences": "daily is safe for typical operations; hourly is safe for high-cadence rule changes; off is safe only when the operator has an alternative drift-check discipline. The elicit prompts at apply time.",
+  "adrId": "ADR-3704-edge-cloudflare-rate-limiting-drift-audit-cadence",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "proposed",
+  "title": "Drift-audit cadence: off, daily or hourly (elicited; recommendedDefault daily)"
+}

package/rcf/adrs/adr-3801-deploy-hetzner-server-cloud-host-contract.json

@@ -0,0 +1,13 @@
+{
+  "createdAt": "2026-09-07T23:54:35.274Z",
+  "updatedAt": "2026-09-07T23:55:16.994Z",
+  "adrId": "ADR-3801-deploy-hetzner-server-cloud-host-contract",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "proposed",
+  "title": "Cloud host contract: Hetzner Cloud VM as the shipped cloudHost shape (scope global, new topic linuxCloudHostContract)",
+  "context": "T-1 repo-chain ADR mirror for the shipped blueprints/deploy-hetzner-server/contributions/adrs/adr-3801-deploy-hetzner-server-cloud-host-contract.json contribution. An applying project needs a first-class Linux VM contract that container-orchestration and edge-ingress consumers can compose on. The Hetzner Cloud API server resource plus cloud-init user-data provides the shipped v1.0.0 shape per https://docs.hetzner.cloud/. Every applied cloud-host needs one project-wide answer to the linuxCloudHostContract topic; a future non-Hetzner sibling (Vultr, DigitalOcean, Fly.io) would conflict on the same topic.",
+  "decision": "The shipped v1.0.0 default is a Hetzner Cloud server as the linuxCloudHostContract provider. The provisioner reads its shape from the applying manifest and creates a matching live server via the hcloud verbs (or the raw Hetzner Cloud API when provisioningTool=raw-api). The linuxCloudHostContract topic scope is global on this blueprint. recommendedDefault: true. Standards trace clause: Hetzner Cloud API server resource and cloud-init user-data contract per hetzner-round-7-spec-2026-09-07.md.",
+  "consequences": "Consumer blueprints that run on a Linux host (containers, systemd services, tunnel connectors) compose on capabilities: [cloudHost]. Rebuild-from-manifest is always possible: the manifest is the source of truth, the live server is derivative. Drift from the shipped manifest to the live server is out of scope for v1.0.0; a later minor may add a drift-audit runner."
+}

package/rcf/adrs/adr-3802-deploy-hetzner-server-snapshot-cadence.json

@@ -0,0 +1,13 @@
+{
+  "createdAt": "2026-09-07T23:54:35.461Z",
+  "updatedAt": "2026-09-07T23:55:17.558Z",
+  "adrId": "ADR-3802-deploy-hetzner-server-snapshot-cadence",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "proposed",
+  "title": "Snapshot cadence: weekly default, daily and off alternatives, Hetzner-managed backups elicited (scope global, new topic snapshotAndBackupCadence)",
+  "context": "T-1 repo-chain ADR mirror for the shipped blueprints/deploy-hetzner-server/contributions/adrs/adr-3802-deploy-hetzner-server-snapshot-cadence.json contribution. An applying project needs a discipline for how often the Hetzner Cloud server takes a snapshot and whether Hetzner-managed backups are enabled. Hetzner documents snapshots as manual-fire on-demand and Hetzner-managed backups as a paid subscription at 20 percent of monthly server price per https://docs.hetzner.com/cloud/servers/backups-snapshots/overview. Every cloud host needs one project-wide answer to the snapshotAndBackupCadence topic.",
+  "decision": "The shipped v1.0.0 default is weekly snapshot cadence with the snapshot fired by a scheduled runner in the applying project. Alternatives elicited: daily (higher recovery-point-objective, higher storage) and off (no automatic snapshot). Hetzner-managed backups are an elicited paid opt-in that costs 20 percent of monthly server price per the vendor docs; when opted-in, the scheduled snapshot runner still fires so the two mechanisms compose. The snapshotAndBackupCadence topic scope is global on this blueprint. recommendedDefault: true. Standards trace clause: Hetzner Cloud backups-and-snapshots documented pricing and mechanism per hetzner-round-7-spec-2026-09-07.md.",
+  "consequences": "Weekly snapshot on a cx23 costs approximately EUR 0.005 per month in extra storage; daily is approximately EUR 0.035; Hetzner-managed backups add approximately EUR 0.80 per month per server at cx23. The scheduled snapshot runner emits hetznerSnapshotTaken with snapshot id and wall-clock time so the observability sink surfaces the cadence."
+}

package/rcf/adrs/adr-3803-deploy-hetzner-server-provisioning-tool.json

@@ -0,0 +1,13 @@
+{
+  "createdAt": "2026-09-07T23:54:35.647Z",
+  "updatedAt": "2026-09-07T23:55:18.120Z",
+  "adrId": "ADR-3803-deploy-hetzner-server-provisioning-tool",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "proposed",
+  "title": "Provisioning tool: hcloud CLI default, raw Hetzner Cloud API alternative, Terraform rejected",
+  "context": "T-1 repo-chain ADR mirror for the shipped blueprints/deploy-hetzner-server/contributions/adrs/adr-3803-deploy-hetzner-server-provisioning-tool.json contribution. An applying project needs a documented answer to how the provisioner shells out to Hetzner Cloud. Options considered: hcloud CLI (small, self-documenting, JSON output), raw Hetzner Cloud REST API (no CLI dependency, useful when the target host cannot install a binary), Terraform (declarative, adds a second toolchain and a state file). Baz ruling 2026-09-07 09:50Z on decision 18: hcloud not Terraform.",
+  "decision": "The shipped v1.0.0 default is the hcloud CLI as the provisioning tool. Alternative elicited: raw-api (the provisioner fetches the Hetzner Cloud REST API directly). Terraform is a rejected alternative: adds a second toolchain and a state file, neither of which matches the shelf shape (see section 9 of hetzner-round-7-spec-2026-09-07.md). elicited: true. recommendedDefault: hcloud. Standards trace clause: Hetzner Cloud CLI documented resource verbs per hetzner-round-7-spec-2026-09-07.md.",
+  "consequences": "The applying project installs the hcloud binary on the operator laptop and any CI runner that provisions. The raw-api fork is behind the same provisioner facade so no consumer code diverges. The provisioner-facade sole-reader guarantee holds on both paths."
+}

package/rcf/adrs/adr-3804-deploy-hetzner-server-hardening-baseline.json

@@ -0,0 +1,13 @@
+{
+  "createdAt": "2026-09-07T23:54:35.833Z",
+  "updatedAt": "2026-09-07T23:55:18.681Z",
+  "adrId": "ADR-3804-deploy-hetzner-server-hardening-baseline",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "proposed",
+  "title": "Hardening baseline: SSH key-only, root disabled, UFW default-deny, DOCKER-USER chain, fail2ban, unattended-upgrades",
+  "context": "T-1 repo-chain ADR mirror for the shipped blueprints/deploy-hetzner-server/contributions/adrs/adr-3804-deploy-hetzner-server-hardening-baseline.json contribution. Every Hetzner server exposed to the public internet needs a minimum hardening set. Cloud-init landing the set at first boot is the operator-friendly shape (declarative, reproducible, in git). The Debian unattended-upgrades wiki documents the auto-update mechanism; the estate baseline at operator/knowledge/systems/environments/hetzner-cloud/overview.md Security posture baseline names the exact block set.",
+  "decision": "The shipped v1.0.0 hardening baseline is the six blocks: SSH key-only (PasswordAuthentication no), root disabled (PermitRootLogin no), UFW default-deny incoming with 22 and 80 and 443 permitted per the manifest firewall shape, DOCKER-USER iptables chain wired to drop non-conforming egress, fail2ban SSH jail, unattended-upgrades on for security updates. The render-lint probe asserts every block appears in the rendered cloud-init YAML; a mutation removes a block and the probe FAILS naming the missing line. recommendedDefault: true. Standards trace clause: Debian unattended-upgrades wiki AND the estate baseline at operator/knowledge/systems/environments/hetzner-cloud/overview.md Security posture baseline per hetzner-round-7-spec-2026-09-07.md.",
+  "consequences": "The applying project inherits the six-block baseline on every provisioned server. Deviation costs a fresh ADR at the applying project level. The baseline is text plus a rendered template; extension (extra ssh key, extra fail2ban jail) sits on top without rewriting."
+}

package/rcf/adrs/adr-3901-platform-docker-compose-host-contract.json

@@ -0,0 +1,13 @@
+{
+  "createdAt": "2026-09-08T01:42:21.686Z",
+  "updatedAt": "2026-09-08T01:44:12.275Z",
+  "adrId": "ADR-3901-platform-docker-compose-host-contract",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "accepted",
+  "title": "T-2 container host contract: docker compose as source of truth (scope global, new topic containerHostContract)",
+  "context": "An applying project running its stack on a Linux cloudHost needs one shipped contract for how services are declared, wired and brought up on a container-orchestration surface. Round-7 T-2 mints the containerHostContract topic on this ADR. Docker Compose is the shipped v1.0.0 surface (compose.yaml as source of truth, healthchecks required, secrets as files, restart discipline, reverse-proxy as artefact). Every applied container host needs one project-wide answer to the containerHostContract topic; a future non-compose sibling (Docker Swarm, Nomad) would contribute the same topic string with a different mechanism, forcing a DELIBERATE conflict the operator resolves per the round-2 conflict pattern. Standards trace clause: Docker Compose file reference AND Docker Engine install-on-Ubuntu docs per hetzner-round-7-spec-2026-09-07.md.",
+  "decision": "The shipped v1.0.0 default is docker compose on a cloudHost as the containerHostContract provider. A canonical compose.yaml at the repo root drives docker compose up on the applied cloudHost (T-1 deploy-hetzner-server); healthchecks refuse at docker compose config on missing; secrets are file mounts; restart policies are unless-stopped or on-failure; the reverse-proxy config is a first-class versioned artefact per TAC-3904. The containerHostContract topic scope is global on this blueprint; the topic string is containerHostContract (lower camelCase, one concept per topic, no version suffix, per the round-2 rules-for-new-topics clause on the shelf registry). Standards trace clause: Docker Compose file reference AND Docker Engine install-on-Ubuntu docs per hetzner-round-7-spec-2026-09-07.md.",
+  "consequences": "Consumer blueprints that ship as containers declare capabilities: [containerHost] on their applied contract; the round-7 T-3 edge-cloudflare-tunnel reads this capability at apply-time to choose the compose-service runtime. Rebuild-from-manifest is always possible: the compose file is the source of truth, the running stack is derivative. Compose is famously many right ways; over-specifying alienates a project with a defensible different shape, so v1.0.0 pins the small load-bearing set (healthchecks, secrets-as-files, restart discipline, reverse-proxy-as-artefact) and leaves everything else to project-owned ADRs."
+}

package/rcf/adrs/adr-3902-platform-docker-compose-host-reverse-proxy.json

@@ -0,0 +1,13 @@
+{
+  "createdAt": "2026-09-08T01:42:21.872Z",
+  "updatedAt": "2026-09-08T01:44:12.461Z",
+  "adrId": "ADR-3902-platform-docker-compose-host-reverse-proxy",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "accepted",
+  "title": "T-2 reverse proxy choice: caddy default per Baz decision 19; traefik alternative for docker-label auto-discovery; none for tunnel-fronted projects (elicited)",
+  "context": "Compose stacks need a reverse-proxy for HTTPS termination and hostname-to-service routing. Caddy is the estate baseline (dev-01 and ops-01 already run it per Baz decision 19 on 2026-09-07 09:50Z). Traefik has a docker-label auto-discovery model some projects prefer. Some projects front their stack only with the round-7 tunnel and skip a reverse proxy inside compose.",
+  "decision": "The reverse-proxy choice is elicited via the reverseProxy parameter. The shipped default is caddy per Baz decision 19. The alternatives are traefik (for projects that want docker-label auto-discovery) and none (for projects fronted only by the round-7 tunnel). Standards trace clause: Caddy docs AND Traefik docs per hetzner-round-7-spec-2026-09-07.md.",
+  "consequences": "A project applying reverseProxy=caddy gets the caddy/Caddyfile artefact and the caddy reload verb. A project applying reverseProxy=traefik gets the traefik/traefik.yaml artefact and the Traefik equivalent reload verb; docker-label auto-discovery is a project-side pattern the guide names. A project applying reverseProxy=none omits the reverse-proxy service and must apply edge-cloudflare-tunnel (T-3) so ingress terminates at the CF edge."
+}

package/rcf/adrs/adr-3903-platform-docker-compose-host-reject-coolify.json

@@ -0,0 +1,13 @@
+{
+  "createdAt": "2026-09-08T01:42:22.057Z",
+  "updatedAt": "2026-09-08T01:44:12.646Z",
+  "adrId": "ADR-3903-platform-docker-compose-host-reject-coolify",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "accepted",
+  "title": "T-2 Coolify rejected per Baz decision 20 (it shadows what the blueprints contract and adds its own DB and UI as a second source of state)",
+  "context": "Coolify was proposed as a candidate platform-* sibling in the round-7 proposal. It is a self-hosted PaaS with its own database and UI. Baz decision 20 on 2026-09-07 09:50Z ruled Coolify out for round 7.",
+  "decision": "reject; it shadows what the blueprints contract and adds its own DB and UI as a second source of state.",
+  "consequences": "No platform-coolify-host blueprint is scoped in round 7 and no reserved slot is allocated. A future platform-coolify-host sibling mints on operator demand under a fresh scope PR. The standards trace clause on this contribution entry is generic enterprise practice; no vendor-doc URL is claimed for the reject decision."
+}

package/rcf/adrs/adr-3904-platform-docker-compose-host-log-driver.json

@@ -0,0 +1,13 @@
+{
+  "createdAt": "2026-09-08T01:42:22.244Z",
+  "updatedAt": "2026-09-08T01:44:12.833Z",
+  "adrId": "ADR-3904-platform-docker-compose-host-log-driver",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "accepted",
+  "title": "T-2 log driver choice: journald default matching Debian 12 and Ubuntu 24.04 baseline; loki opt-in when the project runs Grafana (elicited)",
+  "context": "Containers write stdout and stderr to a log driver. Debian 12 and Ubuntu 24.04 (the T-1 cloud-init baseline) ship journald. Grafana users on the estate reach for loki as a native sink. A one-choice hard-code loses either journald parity with the OS or loki when the operator runs Grafana.",
+  "decision": "The log driver is elicited via the log-driver parameter. The shipped default is journald matching the Debian 12 and Ubuntu 24.04 baselines T-1 sets up. The alternative is loki, opted into when the applying project runs Grafana. When observability-logging is applied, the compose file wires the elicited driver to that companion. Standards trace clause: generic enterprise practice.",
+  "consequences": "A project applying log-driver=journald gets the systemd-native path; the journald sink is queried via journalctl. A project applying log-driver=loki targets the Grafana loki endpoint; the observability-logging companion supplies the endpoint address. Neither choice adds a runtime npm dependency. The compose-config-lint refuses on any driver value outside the allowed set."
+}

package/rcf/adrs/adr-4001-edge-cloudflare-tunnel-ingress-bridge-contract.json

@@ -0,0 +1,13 @@
+{
+  "createdAt": "2026-09-08T03:23:09.408Z",
+  "updatedAt": "2026-09-08T03:23:09.408Z",
+  "adrId": "ADR-4001-edge-cloudflare-tunnel-ingress-bridge-contract",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "proposed",
+  "title": "T-3 edge ingress bridge contract: Cloudflare Tunnel as the shipped ingress-bridge shape from a cloudHost service to the CF edge (scope global, new topic edgeIngressBridge)",
+  "context": "An applying project running on a Linux cloudHost needs one shipped answer to the question of how a service on that host reaches the public internet without opening origin ports. Round-7 T-3 mints the edgeIngressBridge topic on this ADR. Cloudflare Tunnel is the shipped v1.0.0 mechanism (cloudflared connector out to the CF edge; DNS route on a Cloudflare zone; ingress rules mapping public hostname to internal service URL). Every applied ingress bridge needs one project-wide answer to the edgeIngressBridge topic; a future non-Cloudflare sibling (Tailscale Funnel, Fly.io proxy) would contribute the same topic string with a different mechanism, forcing a DELIBERATE conflict the operator resolves per the round-2 conflict pattern. Standards trace clause: Cloudflare Tunnel overview and get-started documented mechanics per hetzner-round-7-spec-2026-09-07.md.",
+  "decision": "The shipped v1.0.0 default is a Cloudflare Tunnel connector as the edgeIngressBridge provider. A cloudflared connector on the applying host (compose service by default when containerHost is applied per ADR-4002; systemd unit on a bare cloudHost) reads a tunnel manifest at cloudflare/tunnels/<name>.yaml and terminates ingress at the CF edge. The edgeIngressBridge topic scope is global on this blueprint; the topic string is edgeIngressBridge (lower camelCase, one concept per topic, no version suffix, per the round-2 rules-for-new-topics clause on the shelf registry). Standards trace clause: Cloudflare Tunnel overview and get-started documented mechanics per hetzner-round-7-spec-2026-09-07.md.",
+  "consequences": "Consumer blueprints that expose a service publicly declare capabilities: [tunnelBridge] on their applied contract to know a bridge is in place. Composition with zeroTrustGate (edge-cloudflare-access) toggles the Access-gated ingress shape per ADR-4003. A T-3-only project (no reverse proxy) declares no 80/443 firewall rule; the tunnel is the sole path from the edge to the origin. Rebuild-from-manifest is always possible: the manifest is the source of truth, the running connector is derivative. Folding this shape into edge-cloudflare-access was rejected: Access is an authorisation gate, Tunnel is an ingress bridge; the responsibilities are distinct and one applies without the other."
+}

package/rcf/adrs/adr-4002-edge-cloudflare-tunnel-connector-runtime.json

@@ -0,0 +1,13 @@
+{
+  "createdAt": "2026-09-08T03:23:09.604Z",
+  "updatedAt": "2026-09-08T03:23:09.604Z",
+  "adrId": "ADR-4002-edge-cloudflare-tunnel-connector-runtime",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "proposed",
+  "title": "T-3 connector runtime: compose-service default when containerHost applied; systemd-unit alternative on bare cloudHost",
+  "context": "The cloudflared connector runs in one of two supported vendor shapes: as a container image published on the cloudflared downloads page, or as a systemd unit installed via the vendor package per the cloudflared as-a-service local-configuration-file docs. An applying project running its stack under docker compose has a natural home for the connector alongside its other services (same network, same logging driver, same restart policy). An applying project running bare on the host has no compose stack and needs a systemd unit for boot ordering and journald logging. Standards trace clause: Cloudflare cloudflared as-a-service documented systemd unit per hetzner-round-7-spec-2026-09-07.md.",
+  "decision": "The connector runtime is elicited via ADR-4002 with enum {compose-service, systemd-unit} and recommendedDefault compose-service. When the containerHost capability is applied (T-2 platform-docker-compose-host) the shipped default is compose-service; when the host runs bare (only T-1 applied) the operator picks systemd-unit at apply time. Standards trace clause: Cloudflare cloudflared as-a-service documented systemd unit per hetzner-round-7-spec-2026-09-07.md.",
+  "consequences": "The fixture ships both variants and both pass the local probes (manifest-schema-validate, cloudflared-config-lint, aud-presence-check). A future non-Cloudflare tunnel sibling (Tailscale Funnel, Fly.io proxy) reuses the runtime enum shape but the elicit lives on that siblings own ADR (conflict-by-design on edgeIngressBridge per ADR-4001). The systemd variant carries an install caveat in the guide: the vendor package landed via apt/curl per the as-a-service docs, which is out of scope for the blueprint itself."
+}

package/rcf/adrs/adr-4003-edge-cloudflare-tunnel-hostname-mode.json

@@ -0,0 +1,13 @@
+{
+  "createdAt": "2026-09-08T03:23:09.794Z",
+  "updatedAt": "2026-09-08T03:23:09.794Z",
+  "adrId": "ADR-4003-edge-cloudflare-tunnel-hostname-mode",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "proposed",
+  "title": "T-3 hostname mode: access-gated when zeroTrustGate applied (ingress attaches AUD); public-hostname when absent (block omitted)",
+  "context": "A tunnel can serve a public hostname openly (any request reaches the origin, protected only by whatever authentication the origin itself carries) or Access-gated (cloudflared refuses at the edge any request without a valid Access JWT for a named AUD, per the vendor self-hosted-public-app docs). The hostname mode is not elicited: it is DISCOVERED from the applied capability set. When zeroTrustGate is applied (edge-cloudflare-access v1.0.0), the tunnel binds the Access AUD; when it is not, the tunnel serves in public-hostname mode. Standards trace clause: Cloudflare Access self-hosted-public-app documented shape per hetzner-round-7-spec-2026-09-07.md.",
+  "decision": "ADR-4003 records the hostname mode as elicited: false and discovered from applied capabilities via the sidecar rcf/blueprints/edge-cloudflare-tunnel.applied.json. When appliedCapabilities includes zeroTrustGate, every ingress rule under the tunnel manifest attaches an originRequest.access block naming the AUD; when it does not, the block is omitted. The aud-presence-check probe runs on both fixture variants and asserts the shape flips correctly. Standards trace clause: Cloudflare Access self-hosted-public-app documented shape per hetzner-round-7-spec-2026-09-07.md.",
+  "consequences": "A project that applies zeroTrustGate later inherits the Access-gated shape on the next reapply of edge-cloudflare-tunnel without a manual manifest edit; a project that removes zeroTrustGate drops to public-hostname mode explicitly. A silent drift (the sidecar keeps zeroTrustGate but the ingress loses the AUD block) is caught by aud-presence-check refusing before the shape ships. Fixture variants live under cloudflared/*/access-gated and cloudflared/*/public-hostname; the SIMULATE_AUD_DROP mutation on the gated fixture proves the refuse path."
+}

package/rcf/code-nodes/cn-230.json

@@ -0,0 +1,13 @@
+{
+  "cnId": "CN-230",
+  "path": "../../blueprints/platform-cloudflare-kv/blueprint.json",
+  "implementsAcIds": [
+    "AC-5001-1",
+    "AC-5002-1"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-07T10:21:02.415Z",
+  "updatedAt": "2026-09-07T10:21:02.415Z"
+}

package/rcf/code-nodes/cn-231.json

@@ -0,0 +1,14 @@
+{
+  "cnId": "CN-231",
+  "path": "../../packages/rcf-lite/test/fixtures/cf-platform/src/kv-facade.mjs",
+  "implementsAcIds": [
+    "AC-5001-1",
+    "AC-5002-1",
+    "AC-5301-1"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-07T10:21:02.591Z",
+  "updatedAt": "2026-09-07T10:21:02.591Z"
+}

package/rcf/code-nodes/cn-232.json

@@ -0,0 +1,13 @@
+{
+  "cnId": "CN-232",
+  "path": "../../packages/rcf-lite/test/fixtures/cf-platform/src/cache-aside.mjs",
+  "implementsAcIds": [
+    "AC-5201-1",
+    "AC-5201-2"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-07T10:21:02.776Z",
+  "updatedAt": "2026-09-07T10:21:02.776Z"
+}

package/rcf/code-nodes/cn-233.json

@@ -0,0 +1,14 @@
+{
+  "cnId": "CN-233",
+  "path": "../../blueprints/platform-cloudflare-kv/contributions/probes/facade-round-trip.mjs",
+  "implementsAcIds": [
+    "AC-5101-1",
+    "AC-5101-2",
+    "AC-5102-1"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-07T10:21:02.953Z",
+  "updatedAt": "2026-09-07T10:21:02.953Z"
+}

package/rcf/code-nodes/cn-234.json

@@ -0,0 +1,13 @@
+{
+  "cnId": "CN-234",
+  "path": "../../blueprints/platform-cloudflare-kv/contributions/probes/event-secrecy.mjs",
+  "implementsAcIds": [
+    "AC-5302-1",
+    "AC-5401-1"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-07T10:21:03.129Z",
+  "updatedAt": "2026-09-07T10:21:03.129Z"
+}

package/rcf/code-nodes/cn-260.json

@@ -0,0 +1,21 @@
+{
+  "cnId": "CN-260",
+  "path": "../../blueprints/platform-cloudflare-cron-triggers/blueprint.json",
+  "implementsAcIds": [
+    "AC-6001-1",
+    "AC-6002-1",
+    "AC-6003-1",
+    "AC-6101-1",
+    "AC-6101-2",
+    "AC-6201-1",
+    "AC-6201-2",
+    "AC-6301-1",
+    "AC-6301-2",
+    "AC-6302-1"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-07T12:30:06.513Z",
+  "updatedAt": "2026-09-07T12:30:06.513Z"
+}

package/rcf/code-nodes/cn-261.json

@@ -0,0 +1,14 @@
+{
+  "cnId": "CN-261",
+  "path": "../../packages/rcf-lite/test/fixtures/cf-platform/src/scheduled.mjs",
+  "implementsAcIds": [
+    "AC-6001-1",
+    "AC-6002-1",
+    "AC-6003-1"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-07T12:30:06.692Z",
+  "updatedAt": "2026-09-07T12:30:06.692Z"
+}

package/rcf/code-nodes/cn-262.json

@@ -0,0 +1,18 @@
+{
+  "cnId": "CN-262",
+  "path": "../../packages/rcf-lite/test/fixtures/cf-platform/src/dispatcher.mjs",
+  "implementsAcIds": [
+    "AC-6101-1",
+    "AC-6101-2",
+    "AC-6201-1",
+    "AC-6201-2",
+    "AC-6301-1",
+    "AC-6301-2",
+    "AC-6302-1"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-07T12:30:06.871Z",
+  "updatedAt": "2026-09-07T12:30:06.871Z"
+}

package/rcf/code-nodes/cn-263.json

@@ -0,0 +1,12 @@
+{
+  "cnId": "CN-263",
+  "path": "../../blueprints/platform-cloudflare-cron-triggers/contributions/probes/wrangler-test-scheduled.mjs",
+  "implementsAcIds": [
+    "AC-6002-1"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-07T12:30:07.051Z",
+  "updatedAt": "2026-09-07T12:30:07.051Z"
+}

package/rcf/code-nodes/cn-264.json

@@ -0,0 +1,13 @@
+{
+  "cnId": "CN-264",
+  "path": "../../blueprints/platform-cloudflare-cron-triggers/contributions/probes/dispatcher-routing.mjs",
+  "implementsAcIds": [
+    "AC-6101-1",
+    "AC-6101-2"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-07T12:30:07.230Z",
+  "updatedAt": "2026-09-07T12:30:07.230Z"
+}

package/rcf/code-nodes/cn-265.json

@@ -0,0 +1,15 @@
+{
+  "cnId": "CN-265",
+  "path": "../../blueprints/platform-cloudflare-cron-triggers/contributions/probes/skew-tolerance.mjs",
+  "implementsAcIds": [
+    "AC-6201-1",
+    "AC-6201-2",
+    "AC-6301-1",
+    "AC-6301-2"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-07T12:30:07.420Z",
+  "updatedAt": "2026-09-07T12:30:07.420Z"
+}

package/rcf/code-nodes/cn-266.json

@@ -0,0 +1,12 @@
+{
+  "cnId": "CN-266",
+  "path": "../../blueprints/platform-cloudflare-cron-triggers/contributions/probes/event-secrecy.mjs",
+  "implementsAcIds": [
+    "AC-6302-1"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-07T12:30:07.601Z",
+  "updatedAt": "2026-09-07T12:30:07.601Z"
+}

package/rcf/code-nodes/cn-267.json

@@ -0,0 +1,12 @@
+{
+  "cnId": "CN-267",
+  "path": "../../blueprints/platform-cloudflare-cron-triggers/contributions/probes/real-account-scheduled-smoke.mjs",
+  "implementsAcIds": [
+    "AC-6003-1"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-07T12:30:07.781Z",
+  "updatedAt": "2026-09-07T12:30:07.781Z"
+}

package/rcf/code-nodes/cn-290.json

@@ -0,0 +1,21 @@
+{
+  "cnId": "CN-290",
+  "path": "../../blueprints/platform-cloudflare-durable-objects/blueprint.json",
+  "implementsAcIds": [
+    "AC-7001-1",
+    "AC-7002-1",
+    "AC-7101-1",
+    "AC-7201-1",
+    "AC-7301-1",
+    "AC-7401-1",
+    "AC-7402-1",
+    "AC-7501-1",
+    "AC-7601-1",
+    "AC-7701-1"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-07T14:14:56.717Z",
+  "updatedAt": "2026-09-07T14:14:56.717Z"
+}

package/rcf/code-nodes/cn-291.json

@@ -0,0 +1,12 @@
+{
+  "cnId": "CN-291",
+  "path": "../../packages/rcf-lite/test/fixtures/cf-platform/wrangler.toml",
+  "implementsAcIds": [
+    "AC-7701-1"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-07T14:14:56.902Z",
+  "updatedAt": "2026-09-07T14:14:56.902Z"
+}

package/rcf/code-nodes/cn-292.json

@@ -0,0 +1,13 @@
+{
+  "cnId": "CN-292",
+  "path": "../../packages/rcf-lite/test/fixtures/cf-platform/src/do-facade.mjs",
+  "implementsAcIds": [
+    "AC-7001-1",
+    "AC-7601-1"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-07T14:14:57.089Z",
+  "updatedAt": "2026-09-07T14:14:57.089Z"
+}

package/rcf/code-nodes/cn-293.json

@@ -0,0 +1,13 @@
+{
+  "cnId": "CN-293",
+  "path": "../../packages/rcf-lite/test/fixtures/cf-platform/src/do-single-cell.mjs",
+  "implementsAcIds": [
+    "AC-7101-1",
+    "AC-7301-1"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-07T14:14:57.275Z",
+  "updatedAt": "2026-09-07T14:14:57.275Z"
+}