rcf-lite 0.23.0 → 0.25.0

package/rcf/code-nodes/cn-294.json

@@ -0,0 +1,13 @@
+{
+  "cnId": "CN-294",
+  "path": "../../packages/rcf-lite/test/fixtures/cf-platform/src/do-hub.mjs",
+  "implementsAcIds": [
+    "AC-7401-1",
+    "AC-7402-1"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-07T14:14:57.462Z",
+  "updatedAt": "2026-09-07T14:14:57.462Z"
+}

package/rcf/code-nodes/cn-295.json

@@ -0,0 +1,12 @@
+{
+  "cnId": "CN-295",
+  "path": "../../packages/rcf-lite/test/fixtures/cf-platform/src/do-storage.mjs",
+  "implementsAcIds": [
+    "AC-7201-1"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-07T14:14:57.647Z",
+  "updatedAt": "2026-09-07T14:14:57.647Z"
+}

package/rcf/code-nodes/cn-296.json

@@ -0,0 +1,12 @@
+{
+  "cnId": "CN-296",
+  "path": "../../blueprints/platform-cloudflare-durable-objects/contributions/probes/probe-utils.mjs",
+  "implementsAcIds": [
+    "AC-7001-1"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-07T14:14:57.834Z",
+  "updatedAt": "2026-09-07T14:14:57.834Z"
+}

package/rcf/code-nodes/cn-297.json

@@ -0,0 +1,12 @@
+{
+  "cnId": "CN-297",
+  "path": "../../blueprints/platform-cloudflare-durable-objects/contributions/probes/namespace-facade-ready.mjs",
+  "implementsAcIds": [
+    "AC-7001-1"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-07T14:14:58.023Z",
+  "updatedAt": "2026-09-07T14:14:58.023Z"
+}

package/rcf/code-nodes/cn-298.json

@@ -0,0 +1,12 @@
+{
+  "cnId": "CN-298",
+  "path": "../../blueprints/platform-cloudflare-durable-objects/contributions/probes/single-cell-concurrent-increment.mjs",
+  "implementsAcIds": [
+    "AC-7101-1"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-07T14:14:58.220Z",
+  "updatedAt": "2026-09-07T14:14:58.220Z"
+}

package/rcf/code-nodes/cn-299.json

@@ -0,0 +1,12 @@
+{
+  "cnId": "CN-299",
+  "path": "../../blueprints/platform-cloudflare-durable-objects/contributions/probes/storage-round-trip.mjs",
+  "implementsAcIds": [
+    "AC-7201-1"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-07T14:14:58.410Z",
+  "updatedAt": "2026-09-07T14:14:58.410Z"
+}

package/rcf/code-nodes/cn-300.json

@@ -0,0 +1,12 @@
+{
+  "cnId": "CN-300",
+  "path": "../../blueprints/platform-cloudflare-durable-objects/contributions/probes/alarm-fires-once.mjs",
+  "implementsAcIds": [
+    "AC-7301-1"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-07T14:14:58.597Z",
+  "updatedAt": "2026-09-07T14:14:58.597Z"
+}

package/rcf/code-nodes/cn-301.json

@@ -0,0 +1,14 @@
+{
+  "cnId": "CN-301",
+  "path": "../../blueprints/platform-cloudflare-durable-objects/contributions/probes/websocket-hub-broadcast.mjs",
+  "implementsAcIds": [
+    "AC-7401-1",
+    "AC-7402-1",
+    "AC-7501-1"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-07T14:14:58.784Z",
+  "updatedAt": "2026-09-07T14:14:58.784Z"
+}

package/rcf/code-nodes/cn-302.json

@@ -0,0 +1,12 @@
+{
+  "cnId": "CN-302",
+  "path": "../../blueprints/platform-cloudflare-durable-objects/contributions/probes/sole-reader-scan.mjs",
+  "implementsAcIds": [
+    "AC-7601-1"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-07T14:14:58.972Z",
+  "updatedAt": "2026-09-07T14:14:58.972Z"
+}

package/rcf/code-nodes/cn-303.json

@@ -0,0 +1,12 @@
+{
+  "cnId": "CN-303",
+  "path": "../../blueprints/platform-cloudflare-durable-objects/contributions/probes/real-account-storage-smoke.mjs",
+  "implementsAcIds": [
+    "AC-7002-1"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-07T14:14:59.162Z",
+  "updatedAt": "2026-09-07T14:14:59.162Z"
+}

package/rcf/code-nodes/cn-304.json

@@ -0,0 +1,21 @@
+{
+  "cnId": "CN-304",
+  "path": "../../packages/rcf-lite/test/blueprint/platform-cloudflare-durable-objects-anatomy.test.js",
+  "implementsAcIds": [
+    "AC-7001-1",
+    "AC-7002-1",
+    "AC-7101-1",
+    "AC-7201-1",
+    "AC-7301-1",
+    "AC-7401-1",
+    "AC-7402-1",
+    "AC-7501-1",
+    "AC-7601-1",
+    "AC-7701-1"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-07T14:15:21.377Z",
+  "updatedAt": "2026-09-07T14:15:21.377Z"
+}

package/rcf/code-nodes/cn-320.json

@@ -0,0 +1,20 @@
+{
+  "cnId": "CN-320",
+  "path": "../../blueprints/edge-cloudflare-access/blueprint.json",
+  "implementsAcIds": [
+    "AC-8001-1",
+    "AC-8002-1",
+    "AC-8003-1",
+    "AC-8101-1",
+    "AC-8201-1",
+    "AC-8301-1",
+    "AC-8401-1",
+    "AC-8501-1",
+    "AC-8502-1"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-07T16:53:57.879Z",
+  "updatedAt": "2026-09-07T16:53:57.879Z"
+}

package/rcf/code-nodes/cn-321.json

@@ -0,0 +1,14 @@
+{
+  "cnId": "CN-321",
+  "path": "../../blueprints/application-admin-console/blueprint.json",
+  "implementsAcIds": [
+    "AC-8501-1",
+    "AC-8601-1",
+    "AC-8602-1"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-07T16:53:58.062Z",
+  "updatedAt": "2026-09-07T16:53:58.062Z"
+}

package/rcf/code-nodes/cn-350.json

@@ -0,0 +1,19 @@
+{
+  "cnId": "CN-350",
+  "path": "../../blueprints/edge-cloudflare-turnstile/blueprint.json",
+  "implementsAcIds": [
+    "AC-9001-1",
+    "AC-9002-1",
+    "AC-9101-1",
+    "AC-9102-1",
+    "AC-9201-1",
+    "AC-9301-1",
+    "AC-9302-1",
+    "AC-9401-1"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-07T19:56:43.636Z",
+  "updatedAt": "2026-09-07T19:56:43.636Z"
+}

package/rcf/code-nodes/cn-380.json

@@ -0,0 +1,19 @@
+{
+  "cnId": "CN-380",
+  "path": "../../blueprints/edge-cloudflare-rate-limiting/blueprint.json",
+  "implementsAcIds": [
+    "AC-10001-1",
+    "AC-10101-1",
+    "AC-10201-1",
+    "AC-10301-1",
+    "AC-10401-1",
+    "AC-10601-1",
+    "AC-10701-1",
+    "AC-10801-1"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-07T21:41:49.036Z",
+  "updatedAt": "2026-09-07T21:41:49.036Z"
+}

package/rcf/code-nodes/cn-410.json

@@ -0,0 +1,20 @@
+{
+  "cnId": "CN-410",
+  "path": "../../blueprints/deploy-hetzner-server/blueprint.json",
+  "implementsAcIds": [
+    "AC-11001-1",
+    "AC-11101-1",
+    "AC-11102-1",
+    "AC-11201-1",
+    "AC-11202-1",
+    "AC-11301-1",
+    "AC-11401-1",
+    "AC-11402-1",
+    "AC-11501-1"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-07T23:59:16.031Z",
+  "updatedAt": "2026-09-07T23:59:16.220Z"
+}

package/rcf/code-nodes/cn-440.json

@@ -0,0 +1,20 @@
+{
+  "cnId": "CN-440",
+  "path": "../../blueprints/platform-docker-compose-host/blueprint.json",
+  "implementsAcIds": [
+    "AC-12001-1",
+    "AC-12101-1",
+    "AC-12102-1",
+    "AC-12201-1",
+    "AC-12202-1",
+    "AC-12301-1",
+    "AC-12401-1",
+    "AC-12402-1",
+    "AC-12501-1"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-08T01:45:43.708Z",
+  "updatedAt": "2026-09-08T01:45:43.708Z"
+}

package/rcf/code-nodes/cn-470.json

@@ -0,0 +1,19 @@
+{
+  "cnId": "CN-470",
+  "path": "../../blueprints/edge-cloudflare-tunnel/blueprint.json",
+  "implementsAcIds": [
+    "AC-13001-1",
+    "AC-13002-1",
+    "AC-13101-1",
+    "AC-13102-1",
+    "AC-13201-1",
+    "AC-13301-1",
+    "AC-13302-1",
+    "AC-13401-1"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-08T03:25:10.642Z",
+  "updatedAt": "2026-09-08T03:25:10.642Z"
+}

package/rcf/fbs/fbs-070.json

@@ -0,0 +1,24 @@
+{
+  "createdAt": "2026-09-07T10:20:33.274Z",
+  "updatedAt": "2026-09-07T10:20:33.274Z",
+  "acIds": [
+    "AC-5001-1",
+    "AC-5002-1",
+    "AC-5101-1",
+    "AC-5101-2",
+    "AC-5102-1",
+    "AC-5201-1",
+    "AC-5201-2",
+    "AC-5301-1",
+    "AC-5302-1",
+    "AC-5401-1"
+  ],
+  "fbsId": "FBS-070",
+  "prdId": "PRD-001",
+  "bsId": "BS-001",
+  "buildOrder": 53,
+  "executionStatus": "notStarted",
+  "title": "T-1 platform-cloudflare-kv v1.0.0: 5 REQs 8 USs 3 TACs 3 ADRs, cf-platform fixture KV extension, 5 Node-only probes, anatomy test",
+  "summary": "HQ round-6 T-1: platform-cloudflare-kv v1.0.0 blueprint on the shelf under blueprints/platform-cloudflare-kv/ (19 contributions: 5 REQs, 8 USs, 3 TACs, 3 ADRs; contributions target 22 to 26 is guidance; sits below at 19 with well-scoped 8-US coverage per spec section 5.1). Adds cf-platform fixture extension (wrangler.toml [[kv_namespaces]] block, src/kv-facade.mjs sole reader, src/cache-aside.mjs helper, src/kv-driver.mjs in-memory driver realising the Workers KV binding shape). Ships 5 Node-only probes under contributions/probes/ (facade-round-trip, cache-aside-hit-then-miss, event-secrecy, list-with-prefix, real-account-eventual-consistency-smoke; the last is accountBound true and records accountBoundSkipped per spec section 3.5 in CI without CI_HAS_CLOUDFLARE_ACCOUNT). Ships blueprint README, guide, CHANGELOG and docs/topics.md, plus the shelf-wide topics.md registry-row for platform-cloudflare-kv on every other blueprint (29 files) and one keyValueStore row on packages/rcf-lite/docs/blueprint-authoring.md section 6a table. Anatomy test at packages/rcf-lite/test/blueprint/platform-cloudflare-kv-anatomy.test.js covers TS-080..087. Repo chain: REQ-050..054 US-5001..5401 TS-080..087 FBS-070 CN-230..234 minted via rcf define create --id per HQ round-6 T-1 reserved-block ruling 2026-09-07T10:12Z. Base commit origin/main 321371e6.",
+  "dependsOnFbsIds": []
+}

package/rcf/fbs/fbs-080.json

@@ -0,0 +1,24 @@
+{
+  "createdAt": "2026-09-07T12:30:06.334Z",
+  "updatedAt": "2026-09-07T12:51:40.075Z",
+  "acIds": [
+    "AC-6001-1",
+    "AC-6002-1",
+    "AC-6003-1",
+    "AC-6101-1",
+    "AC-6101-2",
+    "AC-6201-1",
+    "AC-6201-2",
+    "AC-6301-1",
+    "AC-6301-2",
+    "AC-6302-1"
+  ],
+  "fbsId": "FBS-080",
+  "prdId": "PRD-001",
+  "bsId": "BS-001",
+  "buildOrder": 54,
+  "executionStatus": "notStarted",
+  "title": "T-2 platform-cloudflare-cron-triggers v1.0.0: 4 REQs 7 USs 10 ACs 3 TACs 3 ADRs, cf-platform fixture cron extension, 5 Node-only probes, anatomy test",
+  "summary": "HQ round-6 T-2: platform-cloudflare-cron-triggers v1.0.0 blueprint on the shelf under blueprints/platform-cloudflare-cron-triggers/ (17 contributions: 4 REQs, 7 USs, 3 TACs, 3 ADRs; contributions target 20 to 24 is guidance; sits below at 17 with well-scoped 7-US coverage per spec section 5.2). Adds cf-platform fixture extension (wrangler.toml [triggers] crons block additive over the T-0 [assets] and T-1 [[kv_namespaces]] blocks, src/scheduled.mjs sole reader of the Cron Trigger event, src/dispatcher.mjs expression-routed dispatcher with skew tolerance and soft budget). Ships 5 Node-only probes under contributions/probes/ (wrangler-test-scheduled drives wrangler dev --test-scheduled on the fixture; dispatcher-routing, skew-tolerance and event-secrecy drive the shipped dispatcher in-process; real-account-scheduled-smoke is accountBound true and records accountBoundSkipped per spec section 3.5 in CI without CI_HAS_CLOUDFLARE_ACCOUNT). Ships blueprint README, guide, CHANGELOG and docs/topics.md, plus the shelf-wide topics.md registry-row for platform-cloudflare-cron-triggers on every other blueprint (31 files) and one scheduledTrigger row on packages/rcf-lite/docs/blueprint-authoring.md section 6a table. Anatomy test at packages/rcf-lite/test/blueprint/platform-cloudflare-cron-triggers-anatomy.test.js covers TS-090..096. Repo chain: REQ-060..063 US-6001..6302 TS-090..096 FBS-080 CN-260..267 minted via rcf define create --id per HQ round-6 T-2 reserved-block ruling 2026-09-07T12:25Z. Base commit origin/main 09e14b4.",
+  "dependsOnFbsIds": []
+}

package/rcf/fbs/fbs-090.json

@@ -0,0 +1,24 @@
+{
+  "createdAt": "2026-09-07T14:14:56.524Z",
+  "updatedAt": "2026-09-07T14:15:21.400Z",
+  "acIds": [
+    "AC-7001-1",
+    "AC-7002-1",
+    "AC-7101-1",
+    "AC-7201-1",
+    "AC-7301-1",
+    "AC-7401-1",
+    "AC-7402-1",
+    "AC-7501-1",
+    "AC-7601-1",
+    "AC-7701-1"
+  ],
+  "fbsId": "FBS-090",
+  "prdId": "PRD-001",
+  "bsId": "BS-001",
+  "buildOrder": 55,
+  "executionStatus": "notStarted",
+  "title": "T-3 platform-cloudflare-durable-objects v1.0.0: 8 REQs 10 USs 10 ACs 5 TACs 5 ADRs, cf-platform fixture DO extension, 7 Node-only probes, anatomy test",
+  "summary": "HQ round-6 T-3: platform-cloudflare-durable-objects v1.0.0 blueprint on the shelf under blueprints/platform-cloudflare-durable-objects/ (30 contributions: 8 REQs, 12 USs on the shipped blueprint at ids US-33101..33112, 5 TACs, 5 ADRs). Adds cf-platform fixture DO extension (wrangler.toml [[durable_objects.bindings]] and [[migrations]] blocks additive over the T-0 [assets], T-1 [[kv_namespaces]] and T-2 [triggers] crons blocks; src/do-facade.mjs sole reader of env.CELL and env.HUB; src/do-single-cell.mjs and src/do-hub.mjs shipping SingleCellObject and HubObject classes; src/do-storage.mjs in-memory storage driver realising both sql and kv backends). Ships 7 Node-only probes under contributions/probes/ (namespace-facade-ready, single-cell-concurrent-increment, storage-round-trip, alarm-fires-once, websocket-hub-broadcast folding AC-33106-1 event-secrecy as an additional result, sole-reader-scan and real-account-storage-smoke that is accountBound true and records accountBoundSkipped per spec section 3.5 in CI without CI_HAS_CLOUDFLARE_ACCOUNT). Ships blueprint README, guide, CHANGELOG and docs/topics.md, plus the shelf-wide topics.md registry-row for platform-cloudflare-durable-objects on every prior blueprint (32 files) and two capability rows on packages/rcf-lite/docs/blueprint-authoring.md section 6a table (strongConsistencyCell and hibernatableWebSocket). Anatomy test at packages/rcf-lite/test/blueprint/platform-cloudflare-durable-objects-anatomy.test.js covers TS-100..109. Repo chain: REQ-070..077 US-7001..7002 US-7101 US-7201 US-7301 US-7401..7402 US-7501 US-7601 US-7701 TS-100..109 FBS-090 CN-290..304 minted via rcf define create --id per HQ round-6 T-3 reserved-block ruling 2026-09-07. Base commit origin/main 20cc40d.",
+  "dependsOnFbsIds": []
+}

package/rcf/fbs/fbs-100.json

@@ -0,0 +1,23 @@
+{
+  "createdAt": "2026-09-07T16:53:43.560Z",
+  "updatedAt": "2026-09-07T17:14:55.992Z",
+  "acIds": [
+    "AC-8001-1",
+    "AC-8002-1",
+    "AC-8003-1",
+    "AC-8101-1",
+    "AC-8201-1",
+    "AC-8301-1",
+    "AC-8401-1",
+    "AC-8501-1",
+    "AC-8502-1"
+  ],
+  "fbsId": "FBS-100",
+  "prdId": "PRD-001",
+  "bsId": "BS-001",
+  "buildOrder": 56,
+  "executionStatus": "notStarted",
+  "title": "T-4 edge-cloudflare-access v1.0.0: 6 REQs 9 USs 9 ACs 4 TACs 4 ADRs, cf-edge fixture with JWT signer + JWKS, 5 Node-only probes + 1 wrangler-seam probe, anatomy test",
+  "summary": "HQ round-6 T-4: edge-cloudflare-access v1.0.0 blueprint on the shelf under blueprints/edge-cloudflare-access/. Ships cf-edge fixture with sole-reader JWT validator (Node crypto RS256), local JWKS server and fixture-JWT signer; 6 Node-only probes (4 in-process pass, 1 admin-console gate-surface, 1 accountBound real-account, 1 wrangler-seam warn-on-bind-miss); README, guide with Zero Trust dashboard walk-through and API alternative plus policy shape enum table and break-glass section, CHANGELOG, docs/topics.md; shelf-wide topics.md sweep on 33 blueprints; section 6a zeroTrustGate row on packages/rcf-lite/docs/blueprint-authoring.md. Repo chain: REQ-080..085, US-8001..8502, TS-110..119 plus TCs, FBS-100..101, CN-320..321, TAC-3501..3504, ADR-3501..3504 minted via rcf define create --id per HQ round-6 T-4 reserved-block ruling 2026-09-07. Base commit origin/main cdf84ee.",
+  "dependsOnFbsIds": []
+}

package/rcf/fbs/fbs-101.json

@@ -0,0 +1,16 @@
+{
+  "createdAt": "2026-09-07T16:53:43.745Z",
+  "updatedAt": "2026-09-07T17:14:56.177Z",
+  "acIds": [
+    "AC-8601-1",
+    "AC-8602-1"
+  ],
+  "fbsId": "FBS-101",
+  "prdId": "PRD-001",
+  "bsId": "BS-001",
+  "buildOrder": 57,
+  "executionStatus": "notStarted",
+  "title": "T-4 application-admin-console v1.1.0 additive minor: consume zeroTrustGate optionally, Access-gated sign-in surface pack check AC-21815-1 on the existing application-admin-console.pack.mjs",
+  "summary": "HQ round-6 T-4: application-admin-console v1.1.0 additive minor riding the edge-cloudflare-access PR (round-4 T-4 capability-minor pattern). Bumps blueprint.json to 1.1.0 with 6 new contributions: REQ-014, US-21815, US-21816, TAC-2214, ADR-2214 (scope global on new topic adminConsoleSignInSurface) and pack check AC-21815-1. Extends probe-pack-application-admin-console fixture with /admin/sign-in route. Updates admin-console CHANGELOG with v1.1.0 entry and guide with Access-gate consumption section. Q4 default: consumption is OPTIONAL. Repo chain: REQ-086, US-8601..8602, TAC-2214, ADR-2214.",
+  "dependsOnFbsIds": []
+}

package/rcf/fbs/fbs-110.json

@@ -0,0 +1,23 @@
+{
+  "createdAt": "2026-09-07T19:56:43.448Z",
+  "updatedAt": "2026-09-07T20:06:57.412Z",
+  "summary": "HQ round-6 T-5: edge-cloudflare-turnstile v1.0.0 blueprint on the shelf under blueprints/edge-cloudflare-turnstile/. Ships client widget mount (TAC-3601), server-side siteverify verifier plus refuse-if-token-missing guard (TAC-3602) and composition hook into security-auth-magic-link mint surface (TAC-3603). Four Node-only probes: secret-shape-scan, siteverify-fixture (drives live https://challenges.cloudflare.com/turnstile/v0/siteverify with pinned test keys), guard-shape-scan, event-secrecy. One Playwright pack (edge-cloudflare-turnstile.pack.mjs) with four checks: widgetRendered, serverVerified-pass, serverVerified-fail, magicLinkGuard. Dedicated pack fixture at packages/rcf-lite/test/fixtures/probe-pack-edge-cloudflare-turnstile/ (Node HTTP server, pinned test sitekeys plus secrets from Cloudflare public testing page, magic-link mint stub, break switches for missing-token and other-origin). README, guide with widget-mount snippet plus siteverify curl plus composition example, CHANGELOG, docs/topics.md; shelf-wide topics.md sweep; section 6a humanCheck row on packages/rcf-lite/docs/blueprint-authoring.md. Repo chain: REQ-090..094, US-9001, 9002, 9101, 9102, 9201, 9301, 9302, 9401, TS-120..127 plus TCs, FBS-110, CN-350, TAC-3601..3603, ADR-3601..3603 minted via rcf define create --id per HQ round-6 T-5 reserved-block ruling 2026-09-07. Base commit origin/main 4e25a16.",
+  "dependsOnFbsIds": [],
+  "acIds": [
+    "AC-9001-1",
+    "AC-9002-1",
+    "AC-9101-1",
+    "AC-9102-1",
+    "AC-9201-1",
+    "AC-9301-1",
+    "AC-9302-1",
+    "AC-9401-1"
+  ],
+  "fbsId": "FBS-110",
+  "prdId": "PRD-001",
+  "bsId": "BS-001",
+  "buildOrder": 58,
+  "executionStatus": "notStarted",
+  "title": "T-5 edge-cloudflare-turnstile v1.0.0: 5 REQs 8 USs 8 ACs 3 TACs 3 ADRs, dedicated probe-pack-edge-cloudflare-turnstile fixture with pinned test sitekeys, 4 Node-only probes and 1 Playwright pack with 4 checks",
+  "uiBearing": true
+}

package/rcf/fbs/fbs-120.json

@@ -0,0 +1,22 @@
+{
+  "createdAt": "2026-09-07T21:41:48.747Z",
+  "updatedAt": "2026-09-07T21:42:15.451Z",
+  "acIds": [
+    "AC-10001-1",
+    "AC-10101-1",
+    "AC-10201-1",
+    "AC-10301-1",
+    "AC-10401-1",
+    "AC-10601-1",
+    "AC-10701-1",
+    "AC-10801-1"
+  ],
+  "fbsId": "FBS-120",
+  "prdId": "PRD-001",
+  "bsId": "BS-001",
+  "buildOrder": 59,
+  "executionStatus": "notStarted",
+  "title": "T-6 edge-cloudflare-rate-limiting v1.0.0: 5 REQs, 8 USs, 8 ACs, 3 TACs, 4 ADRs, 4 Node-only probes; cf-edge fixture extended with rate-limit manifests, schema, drift-audit runner and induced-failure switches",
+  "summary": "HQ round-6 T-6: edge-cloudflare-rate-limiting v1.0.0 blueprint on the shelf under blueprints/edge-cloudflare-rate-limiting/. Ships local rate-limit rules manifest (TAC-3701 draft-07 JSON Schema plus cf-edge fixture files cloudflare/rate-limits/example.json and api-writes.json), operator-facing management surface documentation with wrangler and dashboard flows (TAC-3702, guide), and the drift-audit runner realisation in the cf-edge fixture (TAC-3703, src/drift-audit-runner.mjs). Four Node-only probes under blueprints/edge-cloudflare-rate-limiting/contributions/probes/: manifest-presence (AC-10001-1/AC-10801-1 under SIMULATE_MANIFEST_MISSING), manifest-schema-validate (AC-10601-1; SIMULATE_SCHEMA_INVALID negative), event-secrecy (AC-10701-1; SIMULATE_EVENT_LEAK_IP negative) and real-account-burst-and-429 (AC-10201-1; accountBound: true, records accountBoundSkipped without CI_HAS_CLOUDFLARE_ACCOUNT per ruling 6). Blueprint README, guide, docs/topics.md, CHANGELOG; shelf-wide topics.md sweep adding the edge-cloudflare-rate-limiting row across every prior blueprint's docs/topics.md; section 6a edgeRateLimit row on packages/rcf-lite/docs/blueprint-authoring.md. Repo chain: REQ-100..104, US-10001, 10101, 10201, 10301, 10401, 10601, 10701, 10801, TS-130..137 plus TCs, FBS-120, CN-380, TAC-3701..3703, ADR-3701..3704 minted via rcf define create --id per HQ round-6 T-6 reserved-block ruling 2026-09-07. Base commit origin/main 5a22ca6.",
+  "dependsOnFbsIds": []
+}

package/rcf/fbs/fbs-130.json

@@ -0,0 +1,23 @@
+{
+  "createdAt": "2026-09-07T23:59:15.656Z",
+  "updatedAt": "2026-09-07T23:59:15.844Z",
+  "acIds": [
+    "AC-11001-1",
+    "AC-11101-1",
+    "AC-11102-1",
+    "AC-11201-1",
+    "AC-11202-1",
+    "AC-11301-1",
+    "AC-11401-1",
+    "AC-11402-1",
+    "AC-11501-1"
+  ],
+  "fbsId": "FBS-130",
+  "prdId": "PRD-001",
+  "bsId": "BS-001",
+  "buildOrder": 60,
+  "executionStatus": "notStarted",
+  "title": "T-1 deploy-hetzner-server v1.0.0: 6 REQs 9 USs 4 TACs 4 ADRs 6 Node-only probes; shared hetzner-throwaway-server fixture mint with provision/destroy/sweep-orphans and dry-run mock",
+  "summary": "HQ round-7 T-1: deploy-hetzner-server v1.0.0 blueprint on the shelf under blueprints/deploy-hetzner-server/ (23 contributions: 6 REQs, 9 USs, 4 TACs, 4 ADRs; inventory per hetzner-round-7-spec-2026-09-07 section 5.1). Mints the shared throwaway-Hetzner-server fixture at packages/rcf-lite/test/fixtures/hetzner-throwaway-server/ (provision.mjs, destroy.mjs, sweep-orphans.mjs, hcloud-mock shim, cloud-init renderer, provisioner-facade proto, hetzner/servers/ci-throwaway.json manifest, README) that T-2 and T-3 will extend. Six Node-only probes under blueprints/deploy-hetzner-server/contributions/probes/: cloud-init-render-lint (AC-11201-1; SIMULATE_HARDENING_DRIFT mutation), manifest-schema-validate (AC-11101-1, AC-11301-1, AC-11401-1; SIMULATE_MANIFEST_INVALID mutation), hcloud-dry-run-mock (AC-11001-1, AC-11501-1; JSON-parser-strip mutation plus event-secrecy leak mutation), real-account-throwaway-server-provision (AC-11102-1; accountBound), real-account-cloud-init-hardened (AC-11202-1; accountBound), real-account-snapshot-on-demand (AC-11402-1; accountBound). Blueprint README, guide, CHANGELOG, docs/topics.md; shelf-wide topics.md sweep adding the deploy-hetzner-server row across every prior blueprint; section 6a cloudHost row on packages/rcf-lite/docs/blueprint-authoring.md. New global topics minted: linuxCloudHostContract, snapshotAndBackupCadence. Repo chain: REQ-110..115, US-11001, 11101, 11102, 11201, 11202, 11301, 11401, 11402, 11501, TS-140 with nine TCs, FBS-130, CN-410, TAC-3801..3804, ADR-3801..3804 minted via rcf define create --id per HQ round-7 T-1 reserved-block ruling (REQ-110..119 / TS-140..149 / FBS-130..139 / CN-410..439). Base commit origin/main 150d9c6.",
+  "dependsOnFbsIds": []
+}

package/rcf/fbs/fbs-140.json

@@ -0,0 +1,23 @@
+{
+  "createdAt": "2026-09-08T01:45:31.629Z",
+  "updatedAt": "2026-09-08T01:45:31.816Z",
+  "acIds": [
+    "AC-12001-1",
+    "AC-12101-1",
+    "AC-12102-1",
+    "AC-12201-1",
+    "AC-12202-1",
+    "AC-12301-1",
+    "AC-12401-1",
+    "AC-12402-1",
+    "AC-12501-1"
+  ],
+  "fbsId": "FBS-140",
+  "prdId": "PRD-001",
+  "bsId": "BS-001",
+  "buildOrder": 61,
+  "executionStatus": "notStarted",
+  "title": "T-2 platform-docker-compose-host v1.0.0: 6 REQs 9 USs 4 TACs 4 ADRs 5 Node-only probes; extend shared hetzner-throwaway-server fixture with compose stack, Caddyfile, secret file mount and healthchecked service",
+  "summary": "HQ round-7 T-2: platform-docker-compose-host v1.0.0 blueprint on the shelf under blueprints/platform-docker-compose-host/ (23 contributions: 6 REQs, 9 USs, 4 TACs, 4 ADRs; inventory per hetzner-round-7-spec-2026-09-07 section 5.2). Extends the shared throwaway-Hetzner-server fixture minted by T-1 (packages/rcf-lite/test/fixtures/hetzner-throwaway-server/) with a compose stack (compose.yaml, caddy/Caddyfile, secrets/web-token file mount, src/serve.mjs healthchecked stub) plus five run-<probe>.mjs delegate shims. Five Node-only probes under blueprints/platform-docker-compose-host/contributions/probes/: compose-config-lint (AC-12201-1, AC-12301-1, AC-12501-1; SIMULATE_MISSING_HEALTHCHECK, SIMULATE_UNCLASSIFIED_RESTART, SIMULATE_UNCLASSIFIED_LOG_DRIVER, SIMULATE_EVENT_SECRECY_LEAK mutations), secrets-as-files-scan (AC-12101-1, AC-12102-1; SIMULATE_PLAINTEXT_SECRET mutation), caddyfile-validate (AC-12401-1; SIMULATE_INVALID_CADDYFILE mutation; runs the caddy:2 vendor container so a caddy binary on PATH is optional), real-account-minimal-stack-up (AC-12202-1; accountBound), real-account-reload-burst (AC-12402-1; accountBound). Blueprint README, guide, CHANGELOG, docs/topics.md; shelf-wide topics.md sweep adding the platform-docker-compose-host row across every prior blueprint; section 6a containerHost row on packages/rcf-lite/docs/blueprint-authoring.md. New global topic minted: containerHostContract. Repo chain: REQ-120..125, US-12001, 12101, 12102, 12201, 12202, 12301, 12401, 12402, 12501, TS-150 with nine TCs, FBS-140, CN-440, TAC-3901..3904, ADR-3901..3904 minted via rcf define create --id per HQ round-7 T-2 reserved-block ruling (REQ-120..129 / TS-150..159 / FBS-140..149 / CN-440..469). Base commit origin/main 30f7b77.",
+  "dependsOnFbsIds": []
+}

package/rcf/fbs/fbs-150.json

@@ -0,0 +1,22 @@
+{
+  "createdAt": "2026-09-08T03:25:02.808Z",
+  "updatedAt": "2026-09-08T03:25:02.808Z",
+  "acIds": [
+    "AC-13001-1",
+    "AC-13002-1",
+    "AC-13101-1",
+    "AC-13102-1",
+    "AC-13201-1",
+    "AC-13301-1",
+    "AC-13302-1",
+    "AC-13401-1"
+  ],
+  "fbsId": "FBS-150",
+  "prdId": "PRD-001",
+  "bsId": "BS-001",
+  "buildOrder": 62,
+  "executionStatus": "notStarted",
+  "title": "T-3 edge-cloudflare-tunnel v1.0.0: 5 REQs 8 USs 3 TACs 3 ADRs 5 Node-only probes; extend shared hetzner-throwaway-server fixture with cloudflared connector (compose-service and systemd-unit variants; access-gated and public-hostname sidecar modes)",
+  "summary": "HQ round-7 T-3: edge-cloudflare-tunnel v1.0.0 blueprint on the shelf under blueprints/edge-cloudflare-tunnel/ (five REQs, eight USs, three TACs, three ADRs; inventory per hetzner-round-7-spec-2026-09-07 section 5.3). Extends the shared throwaway-Hetzner-server fixture minted by T-1 and extended by T-2 (packages/rcf-lite/test/fixtures/hetzner-throwaway-server/) with a cloudflared connector in both runtime shapes (compose-service alongside the T-2 web and caddy services when containerHost is applied; systemd-unit for a bare cloudHost) and both hostname modes (access-gated when zeroTrustGate is applied; public-hostname when absent), all under cloudflared/{compose-service,systemd-unit}/{access-gated,public-hostname}/. Five Node-only probes under blueprints/edge-cloudflare-tunnel/contributions/probes/: manifest-schema-validate (AC-13101-1, AC-13201-1, AC-13401-1; fixture-side SIMULATE_MANIFEST_INVALID_TUNNEL_ID, SIMULATE_MANIFEST_CREDENTIALS_INLINE, SIMULATE_MANIFEST_MISSING_CATCHALL, SIMULATE_ORIGIN_PORT_OPEN, SIMULATE_EVENT_SECRECY_LEAK mutations), cloudflared-config-lint (AC-13102-1; SIMULATE_INGRESS_INVALID mutation; runs the cloudflare/cloudflared vendor container so a cloudflared binary on PATH is optional), aud-presence-check (AC-13301-1, AC-13302-1; SIMULATE_AUD_DROP mutation; runs on both fixture variants and asserts the sidecar-read shape flips), real-account-connector-healthy (AC-13002-1; accountBound on CI_HAS_CLOUDFLARE_ACCOUNT plus CI_HAS_HETZNER_ACCOUNT), real-account-tunnel-hostname-routes (AC-13102-1 (secondary), AC-13301-1 (Access-gated sub-case); accountBound; the Access-gated sub-case additionally reads CI_HAS_CLOUDFLARE_ACCESS per Q4 ratification). Blueprint README, guide, CHANGELOG, docs/topics.md; shelf-wide topics.md sweep adding the edge-cloudflare-tunnel row across every prior blueprint; section 6a tunnelBridge row on packages/rcf-lite/docs/blueprint-authoring.md. New global topic minted: edgeIngressBridge. Repo chain: REQ-130..134, US-13001, 13002, 13101, 13102, 13201, 13301, 13302, 13401, TS-160 with eight TCs, FBS-150, CN-470, TAC-4001..4003, ADR-4001..4003 minted via rcf define create --id per HQ round-7 T-3 reserved-block ruling (REQ-130..139 / TS-160..169 / FBS-150..159 / CN-470..499). Base commit origin/main 6b4df05.",
+  "dependsOnFbsIds": []
+}

package/rcf/requirements/req-050.json

@@ -0,0 +1,18 @@
+{
+  "createdAt": "2026-09-07T10:18:25.168Z",
+  "updatedAt": "2026-09-07T10:20:10.276Z",
+  "reqId": "REQ-050",
+  "prdId": "PRD-001",
+  "title": "T-1 platform-cloudflare-kv v1.0.0 blueprint: the KV facade module is the sole reader of the KV binding and opens on boot with facadeReady",
+  "description": "T-1 platform-cloudflare-kv v1.0.0: one KV facade module in the applied project source tree is the SOLE reader of the Cloudflare Workers KV binding (env.CACHE in the fixture; the elicited binding name in a real project). Every other module that touches KV imports the facade and calls its typed domain verbs (get, getWithMetadata, put, delete, list); no other module dereferences the raw KV binding. On process boot, the facade opens against the bound namespace with a bounded list(limit:1) ready-check and emits a facadeReady lifecycle event on the injected event sink. Chain: HQ round-6 T-1 reserved-block, id block REQ-050..054 / US-5001..5401 / TS-080..087 / FBS-070 / CN-230..234 per HQ chain-block ruling 2026-09-07T10:12Z.",
+  "category": "functional",
+  "domain": "platform",
+  "priority": "must",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [],
+    "reason": "content-pending",
+    "classifiedAt": "2026-09-07T10:18:25.198Z"
+  }
+}

package/rcf/requirements/req-051.json

@@ -0,0 +1,18 @@
+{
+  "createdAt": "2026-09-07T10:18:25.373Z",
+  "updatedAt": "2026-09-07T10:20:10.276Z",
+  "reqId": "REQ-051",
+  "prdId": "PRD-001",
+  "title": "T-1 typed put get delete list verbs with metadata field pattern realise the Workers KV binding shape behind the facade",
+  "description": "T-1 typed put get delete list realise the Workers KV binding shape behind the facade. put(key, value, {ttl, metadata}) writes with expirationTtl and metadata to the binding; get(key) returns null on miss; getWithMetadata(key) returns {value, metadata}; delete(key) is idempotent; list({prefix, limit, cursor}) paginates keys with metadata shape intact per the Cloudflare KV binding contract at https://developers.cloudflare.com/kv/api/. Metadata is a JSON-serialisable object; the shipped default metadata field pattern is {v: number} (elicited).",
+  "category": "functional",
+  "domain": "platform",
+  "priority": "must",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [],
+    "reason": "content-pending",
+    "classifiedAt": "2026-09-07T10:18:25.402Z"
+  }
+}

package/rcf/requirements/req-052.json

@@ -0,0 +1,18 @@
+{
+  "createdAt": "2026-09-07T10:18:25.579Z",
+  "updatedAt": "2026-09-07T10:20:10.276Z",
+  "reqId": "REQ-052",
+  "prdId": "PRD-001",
+  "title": "T-1 cache-aside helper reads local first falls back to origin and writes back with elicited TTL floor 1 second",
+  "description": "T-1 cache-aside helper wraps a domain-origin call with the facade. getOr(key, originFn, {ttl}) reads local first via facade.get; on hit returns the cached value with source cache; on miss invokes originFn, writes back through facade.put with the effective TTL (elicited default 60 seconds per ADR-3202; floor 1 second enforced at this seam; no upper ceiling per Cloudflare KV documented per-namespace limits at https://developers.cloudflare.com/kv/platform/limits/), and returns the fresh value with source origin.",
+  "category": "functional",
+  "domain": "platform",
+  "priority": "must",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [],
+    "reason": "content-pending",
+    "classifiedAt": "2026-09-07T10:18:25.608Z"
+  }
+}