rcf-lite 0.23.0 → 0.25.0

package/rcf/requirements/req-053.json

@@ -0,0 +1,18 @@
+{
+  "createdAt": "2026-09-07T10:18:25.784Z",
+  "updatedAt": "2026-09-07T10:20:10.276Z",
+  "reqId": "REQ-053",
+  "prdId": "PRD-001",
+  "title": "T-1 lifecycle events facadeReady kvHit kvMiss kvWrite carry metadata-only fields key size ttl timestamp",
+  "description": "T-1 lifecycle events. The facade emits facadeReady on the injected sink once the ready-check returns; kvHit on a get that resolves to a non-null value; kvMiss on a get that resolves to null; kvWrite on put and delete. Every event record carries EXACTLY the fields {event, key, size, ttl, timestamp}: no body bytes, no metadata bag pass-through, no user id beyond the key itself. The event-secrecy probe drives this at REQ-053 mechanism reach.",
+  "category": "functional",
+  "domain": "platform",
+  "priority": "must",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [],
+    "reason": "content-pending",
+    "classifiedAt": "2026-09-07T10:18:25.813Z"
+  }
+}

package/rcf/requirements/req-054.json

@@ -0,0 +1,18 @@
+{
+  "createdAt": "2026-09-07T10:18:25.999Z",
+  "updatedAt": "2026-09-07T10:20:10.276Z",
+  "reqId": "REQ-054",
+  "prdId": "PRD-001",
+  "title": "T-1 eventual-consistency note in the guide: a write may not appear on a global read within the same request and the elicited TTL sets the staleness ceiling",
+  "description": "T-1 eventual-consistency note: Workers KV is eventually consistent per the Cloudflare KV consistency documentation at https://developers.cloudflare.com/kv/concepts/how-kv-works/. A write may not appear on a global read within the same request; the elicited cache-aside TTL (default 60 seconds per Cloudflare-documented cache TTL default) sets the staleness ceiling readers observe. The guide surfaces the note and the decision-tree cross-reference to platform-cloudflare-durable-objects for strong-consistency needs (round-6 T-3 owns the DO adapter).",
+  "category": "functional",
+  "domain": "platform",
+  "priority": "must",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [],
+    "reason": "content-pending",
+    "classifiedAt": "2026-09-07T10:18:26.039Z"
+  }
+}

package/rcf/requirements/req-060.json

@@ -0,0 +1,20 @@
+{
+  "createdAt": "2026-09-07T12:26:47.779Z",
+  "updatedAt": "2026-09-07T12:26:47.813Z",
+  "description": "T-2 platform-cloudflare-cron-triggers v1.0.0: one scheduled() handler in the applied project source tree is the SOLE reader of the Cloudflare Workers Cron Trigger event (the event handler shape documented at https://developers.cloudflare.com/workers/configuration/cron-triggers/). The handler binds on boot, wires the dispatcher (REQ-061) and the event sink (per TAC-3303), and emits a cronReady lifecycle event on the injected sink with a metadata-only payload. Chain: HQ round-6 T-2 reserved-block per HQ chain-block ruling 2026-09-07T12:25Z.",
+  "category": "functional",
+  "domain": "platform",
+  "priority": "must",
+  "reqId": "REQ-060",
+  "prdId": "PRD-001",
+  "title": "T-2 platform-cloudflare-cron-triggers v1.0.0 blueprint: the scheduled() handler is the sole reader of the Cron Trigger event and opens on boot with cronReady",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [
+      "none"
+    ],
+    "reason": "keyword-scan",
+    "classifiedAt": "2026-09-07T12:26:47.812Z"
+  }
+}

package/rcf/requirements/req-061.json

@@ -0,0 +1,18 @@
+{
+  "createdAt": "2026-09-07T12:26:47.991Z",
+  "updatedAt": "2026-09-07T12:28:41.280Z",
+  "description": "T-2 platform-cloudflare-cron-triggers v1.0.0: the dispatcher module accepts an ordered map of cron-expression to handler pairs and, on every scheduled() invocation, matches the incoming Cron Trigger event's cron expression against the map and routes exactly to the matched handler. An unmatched expression records an unmatchedExpression event on the sink and the scheduled invocation returns without side effect. The routed handler receives a bounded context {expression, scheduledTime, sink} so its own emissions can be attributed. Chain: HQ round-6 T-2 reserved-block per HQ chain-block ruling 2026-09-07T12:25Z.",
+  "category": "functional",
+  "domain": "platform",
+  "priority": "must",
+  "reqId": "REQ-061",
+  "prdId": "PRD-001",
+  "title": "T-2 expression-router: multiple cron expressions route to distinct handlers by expression match",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [],
+    "reason": "content-pending",
+    "classifiedAt": "2026-09-07T12:29:00.000Z"
+  }
+}

package/rcf/requirements/req-062.json

@@ -0,0 +1,20 @@
+{
+  "createdAt": "2026-09-07T12:26:48.199Z",
+  "updatedAt": "2026-09-07T12:26:48.232Z",
+  "description": "T-2 platform-cloudflare-cron-triggers v1.0.0: an elicited skew-tolerance window (default 30 seconds per ADR-3303; floor 5s, ceiling 5 minutes) governs how the dispatcher classifies a fire. If the observed handler start time is within the window of the event's scheduledTime, the fire's outcome is onTime and a cronFired event carries {expression, scheduledTime, outcome: onTime, duration}. If the observed start is outside the window, a cronSkewed event fires with the delta (observed minus scheduled, in milliseconds) and the outcome is skewed; the handler still runs. Chain: HQ round-6 T-2 reserved-block per HQ chain-block ruling 2026-09-07T12:25Z.",
+  "category": "functional",
+  "domain": "platform",
+  "priority": "must",
+  "reqId": "REQ-062",
+  "prdId": "PRD-001",
+  "title": "T-2 skew tolerance: a fire inside the elicited window is onTime; outside it records cronSkewed with the delta",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [
+      "none"
+    ],
+    "reason": "keyword-scan",
+    "classifiedAt": "2026-09-07T12:26:48.230Z"
+  }
+}

package/rcf/requirements/req-063.json

@@ -0,0 +1,20 @@
+{
+  "createdAt": "2026-09-07T12:26:48.409Z",
+  "updatedAt": "2026-09-07T12:26:48.442Z",
+  "description": "T-2 platform-cloudflare-cron-triggers v1.0.0: an elicited soft-budget duration (default 30 seconds per elicited answer, no floor) governs when a running handler is flagged as stalled. The dispatcher never terminates a handler on soft-budget breach (Cloudflare's platform concern is the sole terminator); it fires a cronStalled event with metadata-only payload {expression, scheduledTime, outcome: stalled, duration, softBudgetMs} at the moment the observed duration crosses the budget and lets the handler continue. Every scheduled-side event record on the sink carries only {expression, scheduledTime, outcome, duration} plus the event tag; handler input closures, PII fields and body bytes never cross the sink boundary. Chain: HQ round-6 T-2 reserved-block per HQ chain-block ruling 2026-09-07T12:25Z.",
+  "category": "functional",
+  "domain": "platform",
+  "priority": "must",
+  "reqId": "REQ-063",
+  "prdId": "PRD-001",
+  "title": "T-2 soft budget and event secrecy: a handler running past the elicited budget logs cronStalled but does not terminate; every event record is metadata-only",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [
+      "none"
+    ],
+    "reason": "keyword-scan",
+    "classifiedAt": "2026-09-07T12:26:48.441Z"
+  }
+}

package/rcf/requirements/req-070.json

@@ -0,0 +1,18 @@
+{
+  "createdAt": "2026-09-07T14:11:36.742Z",
+  "updatedAt": "2026-09-07T14:13:26.508Z",
+  "reqId": "REQ-070",
+  "prdId": "PRD-001",
+  "title": "T-3 platform-cloudflare-durable-objects v1.0.0 blueprint: the DO facade is the sole reader of env.CELL and env.HUB and opens on boot with namespaceReady",
+  "description": "T-3 platform-cloudflare-durable-objects v1.0.0: one DO facade module in the applied project source tree is the SOLE reader of env.CELL and env.HUB (per https://developers.cloudflare.com/durable-objects/). On process boot, the facade wires the injected event sink and emits a namespaceReady lifecycle event with a metadata-only payload; the facade exposes typed handles per named object (cellHandle(name), hubHandle(name)) and never exposes the raw binding to consumers. Chain: HQ round-6 T-3 reserved-block per HQ chain-block ruling 2026-09-07 (REQ-070..079 / US-70xx..79xx / TS-100..109 / FBS-090..099 / CN-290..319).",
+  "category": "functional",
+  "domain": "platform",
+  "priority": "must",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [],
+    "reason": "content-pending",
+    "classifiedAt": "2026-09-07T14:11:36.775Z"
+  }
+}

package/rcf/requirements/req-071.json

@@ -0,0 +1,18 @@
+{
+  "createdAt": "2026-09-07T14:11:36.953Z",
+  "updatedAt": "2026-09-07T14:13:26.508Z",
+  "reqId": "REQ-071",
+  "prdId": "PRD-001",
+  "title": "T-3 single-cell shape exposes typed domain verbs and serialises concurrent invocations per instance",
+  "description": "T-3 single-cell shape: a named SingleCellObject exposes typed domain verbs (increment, read, reset) that wrap the injected storage driver. Cloudflare's documented DO consistency model serialises invocations against the same instance; the shipped class realises that contract via a per-instance FIFO promise queue so a concurrent-increment probe observes the counter sum and one increment observed the other via a written witness (per REQ-071 and AC-33102-1, AC-33109-1).",
+  "category": "functional",
+  "domain": "platform",
+  "priority": "must",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [],
+    "reason": "content-pending",
+    "classifiedAt": "2026-09-07T14:11:36.986Z"
+  }
+}

package/rcf/requirements/req-072.json

@@ -0,0 +1,18 @@
+{
+  "createdAt": "2026-09-07T14:11:37.164Z",
+  "updatedAt": "2026-09-07T14:13:26.508Z",
+  "reqId": "REQ-072",
+  "prdId": "PRD-001",
+  "title": "T-3 storage API provides typed put/get/delete on the object with an elicited backend (SQL or KV)",
+  "description": "T-3 storage API: the object's state.storage surface exposes typed put(key,value), get(key), delete(key) and list({prefix}) verbs. Storage backend is elicited (sql or kv per ADR-3403); the shipped storage driver factory is backend-agnostic and threads through the elicited answer as driver.backend. A storage-round-trip probe drives both backends via a fixture switch (AC-33103-1, AC-33111-1).",
+  "category": "functional",
+  "domain": "platform",
+  "priority": "must",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [],
+    "reason": "content-pending",
+    "classifiedAt": "2026-09-07T14:11:37.197Z"
+  }
+}

package/rcf/requirements/req-073.json

@@ -0,0 +1,18 @@
+{
+  "createdAt": "2026-09-07T14:11:37.377Z",
+  "updatedAt": "2026-09-07T14:13:26.508Z",
+  "reqId": "REQ-073",
+  "prdId": "PRD-001",
+  "title": "T-3 alarm surface fires alarm() exactly once per scheduled time and doAlarmFired carries objectName and scheduledTime",
+  "description": "T-3 alarm surface: a named object supports storage.setAlarm(scheduledTime) and an alarm() handler. The shipped alarm handler drains the persisted alarm from storage on each fire so a second alarm() call on the drained storage does not re-fire for the same schedule; the injected event sink records a doAlarmFired event with {objectName, scheduledTime} metadata fields on each fire (AC-33104-1, AC-33106-1).",
+  "category": "functional",
+  "domain": "platform",
+  "priority": "must",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [],
+    "reason": "content-pending",
+    "classifiedAt": "2026-09-07T14:11:37.412Z"
+  }
+}

package/rcf/requirements/req-074.json

@@ -0,0 +1,18 @@
+{
+  "createdAt": "2026-09-07T14:11:37.592Z",
+  "updatedAt": "2026-09-07T14:13:26.508Z",
+  "reqId": "REQ-074",
+  "prdId": "PRD-001",
+  "title": "T-3 hibernatable WebSocket hub accepts clients via state.acceptWebSocket and the wake handler runs from cold reading the same storage",
+  "description": "T-3 hibernatable WebSocket hub: a named HubObject accepts websocket clients via state.acceptWebSocket, routes each webSocketMessage by JSON type field, and broadcasts to all connected sockets. Storage persists the last broadcast so a re-emerging client can catch up; on hibernate-and-wake the wake handler runs from a cold start, reads the same storage, and emits doWakeUp exactly once (idempotent-by-contract per ADR-3405) (AC-33105-1, AC-33110-1).",
+  "category": "functional",
+  "domain": "platform",
+  "priority": "must",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [],
+    "reason": "content-pending",
+    "classifiedAt": "2026-09-07T14:11:37.625Z"
+  }
+}

package/rcf/requirements/req-075.json

@@ -0,0 +1,18 @@
+{
+  "createdAt": "2026-09-07T14:11:37.805Z",
+  "updatedAt": "2026-09-07T14:13:26.508Z",
+  "reqId": "REQ-075",
+  "prdId": "PRD-001",
+  "title": "T-3 lifecycle events fire at namespace and object level with metadata-only payloads",
+  "description": "T-3 lifecycle events: the facade and both DO classes emit metadata-only records on the injected event sink: namespaceReady (facade), doAccept, doAlarmFired, doWakeUp, doHibernate (object). Every record carries only allowed keys drawn from {event, key, size, ttl, timestamp, objectName, scheduledTime}; no message payloads, request bodies or PII cross the sink. The event-secrecy result on the websocket-hub-broadcast probe (AC-33106-1) covers the metadata-only contract on the shipped path.",
+  "category": "functional",
+  "domain": "platform",
+  "priority": "must",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [],
+    "reason": "content-pending",
+    "classifiedAt": "2026-09-07T14:11:37.838Z"
+  }
+}

package/rcf/requirements/req-076.json

@@ -0,0 +1,18 @@
+{
+  "createdAt": "2026-09-07T14:11:38.018Z",
+  "updatedAt": "2026-09-07T14:13:26.508Z",
+  "reqId": "REQ-076",
+  "prdId": "PRD-001",
+  "title": "T-3 sole-reader guarantee enforced by AST scan: no non-facade module imports env.CELL or env.HUB",
+  "description": "T-3 sole-reader guarantee: the shipped sole-reader-scan probe reads every .mjs/.js/.ts file under the fixture's applied source root, strips block and line comments, and matches literal occurrences of env.CELL and env.HUB against the file path. The clean-fixture pass asserts src/do-facade.mjs is the ONLY file whose live source matches; any other file with a live match is a leak returned as fail (AC-33107-1).",
+  "category": "functional",
+  "domain": "platform",
+  "priority": "must",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [],
+    "reason": "content-pending",
+    "classifiedAt": "2026-09-07T14:11:38.051Z"
+  }
+}

package/rcf/requirements/req-077.json

@@ -0,0 +1,18 @@
+{
+  "createdAt": "2026-09-07T14:11:38.243Z",
+  "updatedAt": "2026-09-07T14:13:26.508Z",
+  "reqId": "REQ-077",
+  "prdId": "PRD-001",
+  "title": "T-3 migration-safe class exports: stable class names committed to wrangler with a paired [[migrations]] block",
+  "description": "T-3 migration-safe class exports: the DO class names are stable strings committed under [[durable_objects.bindings]] blocks in wrangler.toml, and a paired [[migrations]] block records the mint classes under tag \"v1\" per Cloudflare's migration documentation. A rename ships as a subsequent migrations tag; a rename without one is a runtime error the anatomy assertion catches at self-review (AC-33108-1).",
+  "category": "functional",
+  "domain": "platform",
+  "priority": "must",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [],
+    "reason": "content-pending",
+    "classifiedAt": "2026-09-07T14:11:38.275Z"
+  }
+}

package/rcf/requirements/req-080.json

@@ -0,0 +1,18 @@
+{
+  "createdAt": "2026-09-07T16:49:01.509Z",
+  "updatedAt": "2026-09-07T17:14:19.059Z",
+  "reqId": "REQ-080",
+  "prdId": "PRD-001",
+  "title": "T-4 edge-cloudflare-access v1.0.0 blueprint: the Access JWT validator is the sole reader of the Cf-Access-Jwt-Assertion header and reduces principal onto request.auth",
+  "description": "The applying Workers project reaches Cloudflare Access through a single JWT validator module (src/jwt-validator.mjs) that is the ONLY module dereferencing the Cf-Access-Jwt-Assertion header. The validator fetches the JWKS from the elicited endpoint, caches keys per-kid, verifies the JWT and reduces the principal into request.auth as {email, sub, groups}. Chain: HQ round-6 T-4 reserved-block per HQ chain-block ruling 2026-09-07 (REQ-080..089 / US-80xx..89xx / TS-110..119 / FBS-100..109 / CN-320..349).",
+  "category": "functional",
+  "domain": "functional",
+  "priority": "must",
+  "version": "1.0.0",
+  "status": "approved",
+  "shapeClassification": {
+    "shapes": [],
+    "reason": "content-pending",
+    "classifiedAt": "2026-09-07T16:49:01.543Z"
+  }
+}

package/rcf/requirements/req-081.json

@@ -0,0 +1,18 @@
+{
+  "createdAt": "2026-09-07T16:49:11.871Z",
+  "updatedAt": "2026-09-07T17:14:19.252Z",
+  "reqId": "REQ-081",
+  "prdId": "PRD-001",
+  "title": "T-4 edge-cloudflare-access v1.0.0: an Access application is declared with an elicited hostname or self-hosted-app id and an elicited policy shape from the enum",
+  "description": "The blueprint elicits either an Access application hostname or a self-hosted-app id, plus the JWT audience, JWKS URL and a policy shape from the enum. Applying the blueprint records the values on rcf/blueprints/edge-cloudflare-access.applied.json.",
+  "category": "functional",
+  "domain": "functional",
+  "priority": "must",
+  "version": "1.0.0",
+  "status": "approved",
+  "shapeClassification": {
+    "shapes": [],
+    "reason": "content-pending",
+    "classifiedAt": "2026-09-07T16:49:11.906Z"
+  }
+}

package/rcf/requirements/req-082.json

@@ -0,0 +1,18 @@
+{
+  "createdAt": "2026-09-07T16:49:12.089Z",
+  "updatedAt": "2026-09-07T17:14:19.438Z",
+  "reqId": "REQ-082",
+  "prdId": "PRD-001",
+  "title": "T-4 edge-cloudflare-access v1.0.0: the operator issues a Zero Trust policy via the dashboard or the API path documented in the guide",
+  "description": "The shipped guide documents two paths for issuing the Zero Trust policy: a dashboard walk-through screen-by-screen and a curl example against api.cloudflare.com/client/v4/accounts/{account_id}/access/apps/{app_id}/policies per https://developers.cloudflare.com/cloudflare-one/policies/access/.",
+  "category": "functional",
+  "domain": "functional",
+  "priority": "must",
+  "version": "1.0.0",
+  "status": "approved",
+  "shapeClassification": {
+    "shapes": [],
+    "reason": "content-pending",
+    "classifiedAt": "2026-09-07T16:49:12.123Z"
+  }
+}

package/rcf/requirements/req-083.json

@@ -0,0 +1,18 @@
+{
+  "createdAt": "2026-09-07T16:49:12.304Z",
+  "updatedAt": "2026-09-07T17:14:19.647Z",
+  "reqId": "REQ-083",
+  "prdId": "PRD-001",
+  "title": "T-4 edge-cloudflare-access v1.0.0: the audit event carries metadata-only fields email, outcome, timestamp and path with no token value or headers",
+  "description": "Every validate outcome emits one audit event on the injected sink with the metadata-only shape {email, outcome, timestamp, path}. The record is Object.frozen at the boundary; no downstream module can enrich it with a stray token slice.",
+  "category": "functional",
+  "domain": "functional",
+  "priority": "must",
+  "version": "1.0.0",
+  "status": "approved",
+  "shapeClassification": {
+    "shapes": [],
+    "reason": "content-pending",
+    "classifiedAt": "2026-09-07T16:49:12.339Z"
+  }
+}

package/rcf/requirements/req-084.json

@@ -0,0 +1,18 @@
+{
+  "createdAt": "2026-09-07T16:49:12.520Z",
+  "updatedAt": "2026-09-07T17:14:19.838Z",
+  "reqId": "REQ-084",
+  "prdId": "PRD-001",
+  "title": "T-4 edge-cloudflare-access v1.0.0: break-glass posture with an elicited bypass-service-auth token pair for CI-signed automation",
+  "description": "The operator elicits a break-glass service-auth id; the paired secret is delegated to the applied secretsManagement companion. Requests presenting the paired CF-Access-Client-Id and CF-Access-Client-Secret headers authenticate with outcome=bypass.",
+  "category": "functional",
+  "domain": "functional",
+  "priority": "must",
+  "version": "1.0.0",
+  "status": "approved",
+  "shapeClassification": {
+    "shapes": [],
+    "reason": "content-pending",
+    "classifiedAt": "2026-09-07T16:49:12.555Z"
+  }
+}

package/rcf/requirements/req-085.json

@@ -0,0 +1,18 @@
+{
+  "createdAt": "2026-09-07T16:49:12.737Z",
+  "updatedAt": "2026-09-07T17:14:20.026Z",
+  "reqId": "REQ-085",
+  "prdId": "PRD-001",
+  "title": "T-4 edge-cloudflare-access v1.0.0: the composition with application-admin-console flips the sign-in surface when the applied capability set contains zeroTrustGate",
+  "description": "When application-admin-console v1.1.0 is applied alongside edge-cloudflare-access, the admin-console reads appliedCapabilities via readAppliedCapabilities() at apply-time and flips its sign-in surface between Access-gated and local-login.",
+  "category": "functional",
+  "domain": "functional",
+  "priority": "must",
+  "version": "1.0.0",
+  "status": "approved",
+  "shapeClassification": {
+    "shapes": [],
+    "reason": "content-pending",
+    "classifiedAt": "2026-09-07T16:49:12.772Z"
+  }
+}

package/rcf/requirements/req-086.json

@@ -0,0 +1,18 @@
+{
+  "createdAt": "2026-09-07T16:49:12.954Z",
+  "updatedAt": "2026-09-07T17:14:20.211Z",
+  "reqId": "REQ-086",
+  "prdId": "PRD-001",
+  "title": "T-4 application-admin-console v1.1.0 minor: consume zeroTrustGate optionally, replacing the local sign-in form with an Access-gated surface when the capability is applied",
+  "description": "application-admin-console v1.1.0 additive minor: consumes zeroTrustGate optionally, replacing the local sign-in form with an Access-gated surface when the capability is applied. Q4 default: consumption is OPTIONAL; principalDirectory remains the sole hard requirement (making Access-gate hard is a v2.0 change).",
+  "category": "functional",
+  "domain": "functional",
+  "priority": "must",
+  "version": "1.0.0",
+  "status": "approved",
+  "shapeClassification": {
+    "shapes": [],
+    "reason": "content-pending",
+    "classifiedAt": "2026-09-07T16:49:12.990Z"
+  }
+}

package/rcf/requirements/req-090.json

@@ -0,0 +1,44 @@
+{
+  "createdAt": "2026-09-07T19:54:00.724Z",
+  "updatedAt": "2026-09-07T20:18:17.227Z",
+  "description": "The applying project reaches Cloudflare Turnstile through a client widget mount that renders on elicited surfaces using the elicited TURNSTILE_SITEKEY. The mount injects only Cloudflare Turnstile JS (challenges.cloudflare.com/turnstile/v0/api.js) and no other third-party script. On submit the widget populates a hidden Cf-Turnstile-Response token field in the form payload. Chain: HQ round-6 T-5 reserved-block per HQ chain-block ruling 2026-09-07 (REQ-090..099 / US-90xx..94xx / TS-120..129 / FBS-110..119 / CN-350..379).",
+  "reqId": "REQ-090",
+  "prdId": "PRD-001",
+  "title": "T-5 edge-cloudflare-turnstile v1.0.0 blueprint: the Turnstile client widget mounts with an elicited sitekey and injects no third-party script beyond Cloudflare Turnstile JS host",
+  "category": "functional",
+  "domain": "functional",
+  "priority": "must",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [
+      "webUi",
+      "httpApi",
+      "auth"
+    ],
+    "reason": "keyword-scan",
+    "classifiedAt": "2026-09-07T19:54:00.763Z",
+    "signals": [
+      {
+        "source": "description",
+        "shape": "webUi",
+        "match": "renders"
+      },
+      {
+        "source": "description",
+        "shape": "httpApi",
+        "match": "api"
+      },
+      {
+        "source": "description",
+        "shape": "auth",
+        "match": "token"
+      },
+      {
+        "source": "description",
+        "shape": "webUi",
+        "match": "form"
+      }
+    ]
+  }
+}

package/rcf/requirements/req-091.json

@@ -0,0 +1,53 @@
+{
+  "createdAt": "2026-09-07T19:54:00.947Z",
+  "updatedAt": "2026-09-07T20:18:17.412Z",
+  "description": "The applying project verifies every Turnstile response token server-side by POSTing {secret: TURNSTILE_SECRET, response: <token>} to https://challenges.cloudflare.com/turnstile/v0/siteverify per Cloudflare Turnstile documented endpoint. On success:true the handler proceeds; on success:false the handler rejects with 400 and the refusal body carries the error-codes[] value, not the sitekey or secret.",
+  "reqId": "REQ-091",
+  "prdId": "PRD-001",
+  "title": "T-5 edge-cloudflare-turnstile v1.0.0: server-side siteverify POSTs the response token to challenges.cloudflare.com/turnstile/v0/siteverify with the elicited secret",
+  "category": "functional",
+  "domain": "functional",
+  "priority": "must",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [
+      "httpApi",
+      "auth"
+    ],
+    "reason": "keyword-scan",
+    "classifiedAt": "2026-09-07T19:54:00.984Z",
+    "signals": [
+      {
+        "source": "title",
+        "shape": "httpApi",
+        "match": "POST"
+      },
+      {
+        "source": "title",
+        "shape": "auth",
+        "match": "token"
+      },
+      {
+        "source": "description",
+        "shape": "auth",
+        "match": "token"
+      },
+      {
+        "source": "description",
+        "shape": "httpApi",
+        "match": "POST"
+      },
+      {
+        "source": "description",
+        "shape": "auth",
+        "match": "token"
+      },
+      {
+        "source": "description",
+        "shape": "httpApi",
+        "match": "endpoint"
+      }
+    ]
+  }
+}

package/rcf/requirements/req-092.json

@@ -0,0 +1,32 @@
+{
+  "createdAt": "2026-09-07T19:54:01.170Z",
+  "updatedAt": "2026-09-07T20:18:17.597Z",
+  "description": "The applying project registers a token-required guard at every elicited surface. A submit whose payload lacks the Cf-Turnstile-Response field is rejected with 400 before any downstream handler runs. The refusal body carries a stable error-code, not the sitekey.",
+  "reqId": "REQ-092",
+  "prdId": "PRD-001",
+  "title": "T-5 edge-cloudflare-turnstile v1.0.0: refuse-if-token-missing guard on elicited surfaces rejects submit with 400 before any downstream logic",
+  "category": "functional",
+  "domain": "functional",
+  "priority": "must",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [
+      "auth"
+    ],
+    "reason": "keyword-scan",
+    "classifiedAt": "2026-09-07T19:54:01.209Z",
+    "signals": [
+      {
+        "source": "title",
+        "shape": "auth",
+        "match": "token"
+      },
+      {
+        "source": "description",
+        "shape": "auth",
+        "match": "token"
+      }
+    ]
+  }
+}

package/rcf/requirements/req-093.json

@@ -0,0 +1,52 @@
+{
+  "createdAt": "2026-09-07T19:54:01.402Z",
+  "updatedAt": "2026-09-07T20:18:17.783Z",
+  "description": "When both security-auth-magic-link and edge-cloudflare-turnstile are applied, the magic-link mint surface reads through the Turnstile guard: a mint submit without a valid Turnstile response is refused with 400 before the mint fires. Composition uses the TAC-3603 hook on the shipped magic-link mint surface.",
+  "reqId": "REQ-093",
+  "prdId": "PRD-001",
+  "title": "T-5 edge-cloudflare-turnstile v1.0.0: composition with security-auth-magic-link refuses magic-link mint without a valid Turnstile token",
+  "category": "functional",
+  "domain": "functional",
+  "priority": "must",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [
+      "auth"
+    ],
+    "reason": "keyword-scan",
+    "classifiedAt": "2026-09-07T19:54:01.439Z",
+    "signals": [
+      {
+        "source": "title",
+        "shape": "auth",
+        "match": "magic-link"
+      },
+      {
+        "source": "title",
+        "shape": "auth",
+        "match": "magic-link"
+      },
+      {
+        "source": "title",
+        "shape": "auth",
+        "match": "token"
+      },
+      {
+        "source": "description",
+        "shape": "auth",
+        "match": "magic-link"
+      },
+      {
+        "source": "description",
+        "shape": "auth",
+        "match": "magic-link"
+      },
+      {
+        "source": "description",
+        "shape": "auth",
+        "match": "magic-link"
+      }
+    ]
+  }
+}

package/rcf/requirements/req-094.json

@@ -0,0 +1,32 @@
+{
+  "createdAt": "2026-09-07T19:54:01.626Z",
+  "updatedAt": "2026-09-07T20:18:17.970Z",
+  "description": "The applying operator elicits one of Cloudflare Turnstile documented widget modes: managed (default; renders challenge only when Cloudflare deems it necessary), non-interactive (always renders a non-interactive challenge) or invisible (mounts an invisible widget). The default mode is managed per the shipped ADR.",
+  "reqId": "REQ-094",
+  "prdId": "PRD-001",
+  "title": "T-5 edge-cloudflare-turnstile v1.0.0: widget mode is an elicited enum (managed, non-interactive, invisible) per Cloudflare documented modes; recommendedDefault is managed",
+  "category": "functional",
+  "domain": "functional",
+  "priority": "must",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [
+      "webUi"
+    ],
+    "reason": "keyword-scan",
+    "classifiedAt": "2026-09-07T19:54:01.664Z",
+    "signals": [
+      {
+        "source": "description",
+        "shape": "webUi",
+        "match": "renders"
+      },
+      {
+        "source": "description",
+        "shape": "webUi",
+        "match": "renders"
+      }
+    ]
+  }
+}