rcf-lite 0.23.0 → 0.25.0

package/rcf/requirements/req-134.json

@@ -0,0 +1,42 @@
+{
+  "createdAt": "2026-09-08T03:20:34.180Z",
+  "updatedAt": "2026-09-08T03:20:34.226Z",
+  "description": "The tunnel credentials file the cloudflared connector reads at boot MUST land on the host at mode 0o400 (owner read only), MUST be referenced from the tunnel manifest as a secretRef (never as a literal path to a committed file), MUST NOT be committed to the applying project's git tree (a grep across the working tree for the credentials-file body's uuid-shaped tunnel id and its account-tag literal refuses if either appears in a tracked file), and MUST NOT appear in any cloudflaredReady, tunnelConnectorUp or ingressRuleReloaded event body. A leaked credentials file gives an attacker lateral movement across every hostname the tunnel serves; the discipline is defensive against silent loss. Chain: HQ round-7 T-3 reserved-block per HQ chain-block ruling 2026-09-07. Round-7 T-3 track of hetzner-round-7-spec-2026-09-07 section 5.3.",
+  "reqId": "REQ-134",
+  "prdId": "PRD-001",
+  "title": "T-3 edge-cloudflare-tunnel v1.0.0 blueprint: credentials-file discipline (JSON at mode 0o400, referenced via security-secrets-management, not committed to the applying tree, grep-refuse on the literal)",
+  "category": "functional",
+  "domain": "functional",
+  "priority": "must",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [
+      "auth"
+    ],
+    "reason": "keyword-scan",
+    "classifiedAt": "2026-09-08T03:20:34.225Z",
+    "signals": [
+      {
+        "source": "title",
+        "shape": "auth",
+        "match": "credential"
+      },
+      {
+        "source": "description",
+        "shape": "auth",
+        "match": "credential"
+      },
+      {
+        "source": "description",
+        "shape": "auth",
+        "match": "credential"
+      },
+      {
+        "source": "description",
+        "shape": "auth",
+        "match": "credential"
+      }
+    ]
+  }
+}

package/rcf/tacs/tac-2214-application-admin-console-access-gated-signin-surface.json

@@ -0,0 +1,15 @@
+{
+  "createdAt": "2026-09-07T16:53:45.406Z",
+  "updatedAt": "2026-09-07T17:03:10.394Z",
+  "tacId": "TAC-2214-application-admin-console-access-gated-signin-surface",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "purpose": "Access-gated sign-in surface for application-admin-console v1.1.0: no local form, principal-read from request.auth via [data-role=principal-read]; falls back to local-login when zeroTrustGate absent.",
+  "responsibilities": [
+    "Realise the shape named in the purpose statement.",
+    "Bind the anchored ACs on the shipped probes and the extended admin-console pack."
+  ],
+  "name": "Access-gated sign-in surface shape with principal-read-from-request contract"
+}

package/rcf/tacs/tac-3501-edge-cloudflare-access-jwt-validator.json

@@ -0,0 +1,15 @@
+{
+  "createdAt": "2026-09-07T16:53:43.928Z",
+  "updatedAt": "2026-09-07T17:03:09.639Z",
+  "tacId": "TAC-3501-edge-cloudflare-access-jwt-validator",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "purpose": "Access JWT validator module; sole reader of the Cf-Access-Jwt-Assertion header; JWKS fetch cached per kid; principal reduces to {email, sub, groups}.",
+  "responsibilities": [
+    "Realise the shape named in the purpose statement.",
+    "Bind the anchored ACs on the shipped probes and the extended admin-console pack."
+  ],
+  "name": "Access JWT validator with JWKS fetch and cache"
+}

package/rcf/tacs/tac-3502-edge-cloudflare-access-application-declaration.json

@@ -0,0 +1,15 @@
+{
+  "createdAt": "2026-09-07T16:53:44.112Z",
+  "updatedAt": "2026-09-07T17:03:09.831Z",
+  "tacId": "TAC-3502-edge-cloudflare-access-application-declaration",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "purpose": "Access application declaration surface: elicited hostname or self-hosted-app id plus JWT audience, JWKS URL, policy shape and optional break-glass service-auth pair; recorded on the applied-sidecar.",
+  "responsibilities": [
+    "Realise the shape named in the purpose statement.",
+    "Bind the anchored ACs on the shipped probes and the extended admin-console pack."
+  ],
+  "name": "Access application declaration surface"
+}

package/rcf/tacs/tac-3503-edge-cloudflare-access-policy-shape.json

@@ -0,0 +1,15 @@
+{
+  "createdAt": "2026-09-07T16:53:44.296Z",
+  "updatedAt": "2026-09-07T17:03:10.018Z",
+  "tacId": "TAC-3503-edge-cloudflare-access-policy-shape",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "purpose": "Access policy shape enum with four values: email-domain, service-token-only, service-token-plus-email-domain, group-membership; drives the guide walk-through and the API alternative.",
+  "responsibilities": [
+    "Realise the shape named in the purpose statement.",
+    "Bind the anchored ACs on the shipped probes and the extended admin-console pack."
+  ],
+  "name": "Access policy shape enum and its issuance flow"
+}

package/rcf/tacs/tac-3504-edge-cloudflare-access-audit-sink.json

@@ -0,0 +1,15 @@
+{
+  "createdAt": "2026-09-07T16:53:44.481Z",
+  "updatedAt": "2026-09-07T17:03:10.205Z",
+  "tacId": "TAC-3504-edge-cloudflare-access-audit-sink",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "purpose": "Access audit sink contract: metadata-only shape {email, outcome, timestamp, path}; frozen at the validator boundary; retention delegated to the applied logging companion.",
+  "responsibilities": [
+    "Realise the shape named in the purpose statement.",
+    "Bind the anchored ACs on the shipped probes and the extended admin-console pack."
+  ],
+  "name": "Access audit sink with metadata-only shape"
+}

package/rcf/tacs/tac-3601-edge-cloudflare-turnstile-widget-mount.json

@@ -0,0 +1,15 @@
+{
+  "createdAt": "2026-09-07T19:56:37.865Z",
+  "updatedAt": "2026-09-07T19:56:37.865Z",
+  "purpose": "Turnstile client widget mount module; injects only Cloudflare Turnstile JS (challenges.cloudflare.com); renders with the elicited TURNSTILE_SITEKEY; populates the hidden Cf-Turnstile-Response token field on submit.",
+  "responsibilities": [
+    "Realise the shape named in the purpose statement.",
+    "Bind the anchored ACs on the shipped probes and the Playwright pack."
+  ],
+  "tacId": "TAC-3601-edge-cloudflare-turnstile-widget-mount",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "draft",
+  "name": "Turnstile client widget mount with elicited sitekey and third-party script pin"
+}

package/rcf/tacs/tac-3602-edge-cloudflare-turnstile-server-verifier.json

@@ -0,0 +1,15 @@
+{
+  "createdAt": "2026-09-07T19:56:38.049Z",
+  "updatedAt": "2026-09-07T19:56:38.049Z",
+  "purpose": "Turnstile server-side siteverify verifier; POSTs {secret, response} to https://challenges.cloudflare.com/turnstile/v0/siteverify; on success:true proceeds, on success:false rejects 400 with error-codes body; token-required guard rejects missing-token submits with 400 before any downstream handler runs.",
+  "responsibilities": [
+    "Realise the shape named in the purpose statement.",
+    "Bind the anchored ACs on the shipped probes and the Playwright pack."
+  ],
+  "tacId": "TAC-3602-edge-cloudflare-turnstile-server-verifier",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "draft",
+  "name": "Turnstile server-side siteverify verifier and refuse-if-token-missing guard"
+}

package/rcf/tacs/tac-3603-edge-cloudflare-turnstile-magic-link-hook.json

@@ -0,0 +1,15 @@
+{
+  "createdAt": "2026-09-07T19:56:38.233Z",
+  "updatedAt": "2026-09-07T19:56:38.233Z",
+  "purpose": "Composition hook on the security-auth-magic-link mint surface: the magic-link mint route reads through the Turnstile guard before invoking the mint; a missing or failed Turnstile token refuses the mint with 400.",
+  "responsibilities": [
+    "Realise the shape named in the purpose statement.",
+    "Bind the anchored ACs on the shipped probes and the Playwright pack."
+  ],
+  "tacId": "TAC-3603-edge-cloudflare-turnstile-magic-link-hook",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "draft",
+  "name": "Composition hook into security-auth-magic-link mint surface"
+}

package/rcf/tacs/tac-3701-edge-cloudflare-rate-limiting-manifest-schema.json

@@ -0,0 +1,16 @@
+{
+  "createdAt": "2026-09-07T21:40:45.360Z",
+  "updatedAt": "2026-09-07T21:40:45.360Z",
+  "purpose": "T-6 repo-chain TAC mirror for the shipped blueprints/edge-cloudflare-rate-limiting/contributions/tacs/tac-3701-edge-cloudflare-rate-limiting-manifest-schema.json contribution. Defines the JSON Schema shape and the manifest directory layout for the local rate-limit rules manifest per https://developers.cloudflare.com/waf/rate-limiting-rules/. Anchors AC-10001-1, AC-10601-1, AC-10801-1 (and AC-36101-1, AC-36106-1, AC-36108-1 on the shipped blueprint).",
+  "internalStructure": "One JSON Schema file at blueprints/edge-cloudflare-rate-limiting/contributions/schemas/rate-limit-rule.schema.json (draft-07); one shipped example manifest directory in the cf-edge fixture with two files.",
+  "responsibilities": [
+    "Ship a draft-07 JSON Schema for the rate-limit rule manifest file (AC-10001-1, AC-10601-1).",
+    "Ship the layout the manifest-presence probe scans (AC-10001-1, AC-10801-1)."
+  ],
+  "tacId": "TAC-3701-edge-cloudflare-rate-limiting-manifest-schema",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "draft",
+  "name": "Rate-limit rule manifest schema and manifest layout"
+}

package/rcf/tacs/tac-3702-edge-cloudflare-rate-limiting-management-surface-doc.json

@@ -0,0 +1,15 @@
+{
+  "createdAt": "2026-09-07T21:40:45.647Z",
+  "updatedAt": "2026-09-07T21:40:45.647Z",
+  "purpose": "T-6 repo-chain TAC mirror for the shipped blueprints/edge-cloudflare-rate-limiting/contributions/tacs/tac-3702-edge-cloudflare-rate-limiting-management-surface-doc.json contribution. Defines the operator-facing management surface documentation shape: both a wrangler command flow and a Cloudflare dashboard flow for applying one rule from a manifest file to the elicited zone. Anchors AC-10101-1 and AC-10401-1.",
+  "internalStructure": "One guide file at blueprints/edge-cloudflare-rate-limiting/guide/edge-cloudflare-rate-limiting.md with three named sections: Manifest, Management surface (wrangler and dashboard subsections), Composition with security-auth-magic-link.",
+  "responsibilities": [
+    "Ship the guide with both wrangler and dashboard flows plus the composition example (AC-10101-1, AC-10401-1)."
+  ],
+  "tacId": "TAC-3702-edge-cloudflare-rate-limiting-management-surface-doc",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "draft",
+  "name": "Operator-facing management surface documentation (wrangler and dashboard flows)"
+}

package/rcf/tacs/tac-3703-edge-cloudflare-rate-limiting-drift-audit-runner.json

@@ -0,0 +1,16 @@
+{
+  "createdAt": "2026-09-07T21:40:45.943Z",
+  "updatedAt": "2026-09-07T21:40:45.943Z",
+  "purpose": "T-6 repo-chain TAC mirror for the shipped blueprints/edge-cloudflare-rate-limiting/contributions/tacs/tac-3703-edge-cloudflare-rate-limiting-drift-audit-runner.json contribution. Defines the drift-audit runner: factory shape createDriftAuditRunner({env, eventSink, fetch, clock, cadence, manifestLoader}) that fetches live rules via the Cloudflare API and diffs against the local manifest, constructing metadata-only drift records. Anchors AC-10301-1 and AC-10701-1.",
+  "internalStructure": "One runner module realised in the cf-edge fixture at packages/rcf-lite/test/fixtures/cf-edge/src/drift-audit-runner.mjs. The applying project copies the shape from the blueprint guide; the fixture module is the shape probes drive.",
+  "responsibilities": [
+    "Ship the drift-audit runner factory (AC-10301-1).",
+    "Emit metadata-only audit records via the injected sink, Object.frozen at the boundary (AC-10701-1)."
+  ],
+  "tacId": "TAC-3703-edge-cloudflare-rate-limiting-drift-audit-runner",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "draft",
+  "name": "Drift-audit runner: read live zone rules via the Cloudflare API and diff against the local manifest"
+}

package/rcf/tacs/tac-3801-deploy-hetzner-server-provisioner.json

@@ -0,0 +1,17 @@
+{
+  "createdAt": "2026-09-07T23:53:56.835Z",
+  "updatedAt": "2026-09-07T23:57:58.678Z",
+  "tacId": "TAC-3801-deploy-hetzner-server-provisioner",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "draft",
+  "purpose": "T-1 repo-chain TAC mirror for the shipped blueprints/deploy-hetzner-server/contributions/tacs/tac-3801-deploy-hetzner-server-provisioner.json contribution. Defines the provisioner Node module that wraps hcloud CLI verbs (create server, apply firewall, take snapshot, list snapshots, destroy server) and, under provisioningTool=raw-api, wraps the equivalent Hetzner Cloud REST endpoints. Sole-reader guarantee: only this module reads the HETZNER_ACCOUNT_API_KEY via security-secrets-management (or the project-scoped alternative). Anchors AC-11001-1 (repo chain).",
+  "responsibilities": [
+    "Wrap hcloud CLI verbs (create server, apply firewall, take snapshot, list snapshots, destroy server) and the raw Hetzner Cloud REST endpoints behind one facade (AC-11001-1, AC-11102-1, AC-11402-1).",
+    "Be the sole reader of HETZNER_ACCOUNT_API_KEY via security-secrets-management; every other module reads from the facade (AC-11001-1).",
+    "Emit provisionerReady, hetznerServerProvisioned, hetznerSnapshotTaken and hetznerServerDestroyed with metadata-only payloads (AC-11001-1, AC-11501-1)."
+  ],
+  "name": "deploy-hetzner-server provisioner module: sole reader of the Hetzner API token, hcloud shell path and raw-api fork",
+  "internalStructure": "One module blueprints/deploy-hetzner-server/contributions/tacs/tac-3801-deploy-hetzner-server-provisioner.json plus the provisioner facade proto shipped in the fixture (packages/rcf-lite/test/fixtures/hetzner-throwaway-server/src/provisioner-facade.mjs) reading the token from a single seam and firing provisionerReady on ready()."
+}

package/rcf/tacs/tac-3802-deploy-hetzner-server-manifest-schema.json

@@ -0,0 +1,17 @@
+{
+  "createdAt": "2026-09-07T23:53:57.022Z",
+  "updatedAt": "2026-09-07T23:57:58.866Z",
+  "tacId": "TAC-3802-deploy-hetzner-server-manifest-schema",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "draft",
+  "purpose": "T-1 repo-chain TAC mirror for the shipped blueprints/deploy-hetzner-server/contributions/tacs/tac-3802-deploy-hetzner-server-manifest-schema.json contribution. Defines the JSON Schema shape for the Hetzner server manifest under hetzner/servers/<name>.json: type, location, image, sshKeyIds, firewallId, networkId, cloudInitPath, labels, snapshotCadence. Anchors AC-11101-1 and AC-11102-1 (repo chain).",
+  "responsibilities": [
+    "Ship a draft-07 JSON Schema for the hetzner-server manifest (AC-11101-1, AC-11301-1, AC-11401-1).",
+    "Refuse on required-field violations (missing type, location, image, sshKeyIds, firewallId, cloudInitPath, labels or snapshotCadence).",
+    "Refuse on firewall-rule-shape violations (22 opened to 0.0.0.0/0, or 80/443 missing) (AC-11301-1)."
+  ],
+  "name": "deploy-hetzner-server server manifest schema and file layout at hetzner/servers/*.json",
+  "internalStructure": "One draft-07 JSON Schema at blueprints/deploy-hetzner-server/contributions/schemas/hetzner-server.schema.json and one shipped example manifest under the shared throwaway-server fixture (packages/rcf-lite/test/fixtures/hetzner-throwaway-server/hetzner/servers/ci-throwaway.json)."
+}

package/rcf/tacs/tac-3803-deploy-hetzner-server-cloud-init-template.json

@@ -0,0 +1,17 @@
+{
+  "createdAt": "2026-09-07T23:53:57.210Z",
+  "updatedAt": "2026-09-07T23:57:59.054Z",
+  "tacId": "TAC-3803-deploy-hetzner-server-cloud-init-template",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "draft",
+  "purpose": "T-1 repo-chain TAC mirror for the shipped blueprints/deploy-hetzner-server/contributions/tacs/tac-3803-deploy-hetzner-server-cloud-init-template.json contribution. Defines the cloud-init user-data template landing the six hardening baseline blocks: SSH key-only, root disabled, UFW default-deny incoming, DOCKER-USER iptables chain, fail2ban SSH jail, unattended-upgrades. Local render-lint asserts every block appears in the rendered YAML. Anchors AC-11201-1 and AC-11202-1 (repo chain).",
+  "responsibilities": [
+    "Ship a cloud-init user-data template that renders the six hardening baseline blocks (AC-11201-1, AC-11202-1).",
+    "Provide the render-lint check that asserts each block appears in the rendered YAML (AC-11201-1).",
+    "Cover the SIMULATE_HARDENING_DRIFT mutation with a probe FAILURE that names the missing line (AC-11201-1)."
+  ],
+  "name": "deploy-hetzner-server cloud-init template with the six hardening baseline blocks and render lint",
+  "internalStructure": "One template file at blueprints/deploy-hetzner-server/contributions/templates/cloud-init.yaml.tmpl and one render module at packages/rcf-lite/test/fixtures/hetzner-throwaway-server/src/cloud-init-renderer.mjs; the render-lint probe consumes the rendered output."
+}

package/rcf/tacs/tac-3804-deploy-hetzner-server-firewall-shape.json

@@ -0,0 +1,16 @@
+{
+  "createdAt": "2026-09-07T23:53:57.397Z",
+  "updatedAt": "2026-09-07T23:57:59.243Z",
+  "tacId": "TAC-3804-deploy-hetzner-server-firewall-shape",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "draft",
+  "purpose": "T-1 repo-chain TAC mirror for the shipped blueprints/deploy-hetzner-server/contributions/tacs/tac-3804-deploy-hetzner-server-firewall-shape.json contribution. Defines the Hetzner Cloud firewall rule shape carried inside the server manifest: 22 permitted only from an operator-nominated set of source-prefix ranges; 80/443 permitted from 0.0.0.0/0 for the reverse proxy; all other inbound denied. Manifest schema refuses on a rule set that opens 22 to 0.0.0.0/0 or drops 80/443. Anchors AC-11301-1 (repo chain).",
+  "responsibilities": [
+    "Define the firewall rule shape inside the manifest: 22 permitted only from a nonempty list of source-prefix ranges; 80 and 443 permitted; all other inbound denied (AC-11301-1).",
+    "Refuse (via manifest-schema-validate) on a manifest that opens 22 to 0.0.0.0/0 or drops 80/443."
+  ],
+  "name": "deploy-hetzner-server firewall rule shape: 22 from operator-nominated prefixes, 80/443 open, deny all else, applied at provision time",
+  "internalStructure": "Rule shape carried inside the same hetzner-server.schema.json used by TAC-3802; the applyFirewall verb on the provisioner facade consumes the parsed rule set."
+}

package/rcf/tacs/tac-3901-platform-docker-compose-host-compose-layout.json

@@ -0,0 +1,17 @@
+{
+  "createdAt": "2026-09-08T01:42:20.942Z",
+  "updatedAt": "2026-09-08T01:44:10.970Z",
+  "tacId": "TAC-3901-platform-docker-compose-host-compose-layout",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "draft",
+  "purpose": "The applying project ships one compose.yaml at the repo root whose services key names every container the stack runs. Every entry is one image running one container; networks and volumes are top-level named entries; a colocated .env carries non-secret configuration values (never inline). The container host reads compose.yaml as the runtime topology source and refuses to bring the stack up on layout drift.",
+  "responsibilities": [
+    "Serve compose.yaml at the repo root as the sole topology surface (AC-12001-1, AC-12202-1).",
+    "Guarantee service-per-container: each entry under services: runs one image (AC-12001-1).",
+    "Declare all networks and volumes as top-level named entries: no bare defaults (AC-12001-1).",
+    "Bind non-secret configuration through a colocated .env: no inline literals (AC-12001-1)."
+  ],
+  "name": "T-2 platform-docker-compose-host compose layout"
+}

package/rcf/tacs/tac-3902-platform-docker-compose-host-secrets-mount.json

@@ -0,0 +1,17 @@
+{
+  "createdAt": "2026-09-08T01:42:21.128Z",
+  "updatedAt": "2026-09-08T01:44:11.343Z",
+  "tacId": "TAC-3902-platform-docker-compose-host-secrets-mount",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "draft",
+  "purpose": "The compose file declares each secret under its top-level secrets: key with a file: source. Services reference secrets through their service-level secrets: array so docker mounts them as files at 0o400 inside the container. When security-secrets-management is applied, the source path resolves through that facade; when it is not, the guide names a file-based fallback. No plaintext secret literal appears anywhere in compose.yaml or a referenced service config (grep-refuse).",
+  "responsibilities": [
+    "Declare every secret through a compose secrets: file mount (AC-12101-1, AC-12102-1).",
+    "Refuse a plaintext secret literal anywhere in compose.yaml (AC-12102-1).",
+    "Mount each secret file at 0o400 inside the container (AC-12101-1).",
+    "Bind to security-secrets-management when applied; document the file-based fallback (AC-12101-1)."
+  ],
+  "name": "T-2 platform-docker-compose-host secrets mount"
+}

package/rcf/tacs/tac-3903-platform-docker-compose-host-healthcheck-lint.json

@@ -0,0 +1,17 @@
+{
+  "createdAt": "2026-09-08T01:42:21.313Z",
+  "updatedAt": "2026-09-08T01:44:11.716Z",
+  "tacId": "TAC-3903-platform-docker-compose-host-healthcheck-lint",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "draft",
+  "purpose": "A lint pass runs before docker compose up. It asserts every HTTP-terminating service declares a healthcheck: block; every service declares a restart: policy whose value is one of unless-stopped or on-failure; every service declares a logging: driver: entry whose value is one of journald or loki. The lint refuses on any missing or unclassified line, naming the service and the offending field.",
+  "responsibilities": [
+    "Assert every HTTP-terminating service declares a healthcheck: block (AC-12201-1).",
+    "Assert every service declares a restart policy in the allowed set (AC-12301-1).",
+    "Assert every service declares a logging driver in the allowed set (AC-12501-1).",
+    "Refuse on missing or unclassified fields, naming the service (AC-12201-1, AC-12301-1, AC-12501-1)."
+  ],
+  "name": "T-2 platform-docker-compose-host healthcheck and lifecycle lint"
+}

package/rcf/tacs/tac-3904-platform-docker-compose-host-reverse-proxy-artefact.json

@@ -0,0 +1,17 @@
+{
+  "createdAt": "2026-09-08T01:42:21.500Z",
+  "updatedAt": "2026-09-08T01:44:12.088Z",
+  "tacId": "TAC-3904-platform-docker-compose-host-reverse-proxy-artefact",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "draft",
+  "purpose": "The reverse-proxy config file (caddy/Caddyfile when reverseProxy=caddy, traefik/traefik.yaml when reverseProxy=traefik) lives as a first-class checked-in artefact under the applying repo. The compose file bind-mounts the artefact read-only into the proxy service. The gate runs the vendor validator against the artefact and refuses on an invalid directive. Under the reload verb (docker compose exec caddy caddy reload or the Traefik equivalent), a burst against the proxy inside the elicited window sees no non-2xx and no dropped connection.",
+  "responsibilities": [
+    "Ship the reverse-proxy config as a checked-in artefact bind-mounted into the proxy (AC-12401-1).",
+    "Validate the artefact with the vendor validator at gate time (AC-12401-1).",
+    "Prove zero-downtime reload with a real-account burst (AC-12402-1).",
+    "Name the reload verb per proxy in the guide and the fixture README (AC-12401-1, AC-12402-1)."
+  ],
+  "name": "T-2 platform-docker-compose-host reverse-proxy artefact"
+}

package/rcf/tacs/tac-4001-edge-cloudflare-tunnel-connector-shape.json

@@ -0,0 +1,17 @@
+{
+  "createdAt": "2026-09-08T03:23:08.838Z",
+  "updatedAt": "2026-09-08T03:23:08.838Z",
+  "tacId": "TAC-4001-edge-cloudflare-tunnel-connector-shape",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "draft",
+  "purpose": "The cloudflared connector installs in one of two runtime shapes as selected by ADR-4002 from the applied capability set. When containerHost is applied (T-2 platform-docker-compose-host on top of T-1 deploy-hetzner-server) the connector ships as a compose service alongside the applying project services on the same web-net network with no host ports and a healthcheck. When the host runs bare (only T-1 applied) the connector ships as a systemd unit per the vendor local-configuration-file docs. Either shape emits cloudflaredReady on boot with connector id, region and version metadata (metadata only).",
+  "responsibilities": [
+    "Ship the compose-service variant under packages/rcf-lite/test/fixtures/hetzner-throwaway-server/cloudflared/compose-service/ (AC-13001-1).",
+    "Ship the systemd-unit variant under packages/rcf-lite/test/fixtures/hetzner-throwaway-server/cloudflared/systemd-unit/ (AC-13001-1).",
+    "Emit cloudflaredReady on boot with connector id, region and version metadata (AC-13002-1).",
+    "Never expose an origin port on the host firewall (AC-13201-1)."
+  ],
+  "name": "edge-cloudflare-tunnel TAC"
+}

package/rcf/tacs/tac-4002-edge-cloudflare-tunnel-manifest-schema.json

@@ -0,0 +1,17 @@
+{
+  "createdAt": "2026-09-08T03:23:09.027Z",
+  "updatedAt": "2026-09-08T03:23:09.027Z",
+  "tacId": "TAC-4002-edge-cloudflare-tunnel-manifest-schema",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "draft",
+  "purpose": "The tunnel manifest at cloudflare/tunnels/<name>.yaml under the applying project is the sole runtime source of truth for what the cloudflared connector serves. The shipped JSON schema requires a uuid-shaped tunnel id, a secretRef credentials reference (never a literal path or JSON body inline), and an ingress rules array whose last entry is a catch-all rule returning http_status 404. The schema refuses ingress rules whose service URL binds to a host public interface (only internal addresses reachable through the compose network or a loopback interface are allowed).",
+  "responsibilities": [
+    "Ship the JSON schema at blueprints/edge-cloudflare-tunnel/contributions/probes/tunnel-manifest.schema.json (AC-13101-1).",
+    "Validate the fixture manifests at cloudflared/*/cloudflare/tunnels/probe.yaml on every reviewer boot (AC-13101-1, AC-13102-1).",
+    "Refuse ingress rules that bind to a host public port (AC-13201-1).",
+    "Refuse a manifest whose credentials reference is not a secretRef (AC-13101-1, AC-13401-1)."
+  ],
+  "name": "edge-cloudflare-tunnel TAC"
+}

package/rcf/tacs/tac-4003-edge-cloudflare-tunnel-access-binding.json

@@ -0,0 +1,16 @@
+{
+  "createdAt": "2026-09-08T03:23:09.218Z",
+  "updatedAt": "2026-09-08T03:23:09.218Z",
+  "tacId": "TAC-4003-edge-cloudflare-tunnel-access-binding",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "draft",
+  "purpose": "The blueprint reads the applying project sidecar rcf/blueprints/edge-cloudflare-tunnel.applied.json at apply time and inspects appliedCapabilities. When zeroTrustGate is present every ingress rule attaches an originRequest.access.aud block naming the Access AUD; when absent the block is omitted and the tunnel serves in public-hostname mode. The shape is a pure function of the sidecar and never silently degrades to open ingress.",
+  "responsibilities": [
+    "Ship the aud-presence-check probe module (AC-13301-1, AC-13302-1).",
+    "Ship both fixture variants (access-gated and public-hostname) under cloudflared/*/access-gated and cloudflared/*/public-hostname (AC-13301-1).",
+    "Refuse when the gated variant drifts to open ingress (AC-13302-1)."
+  ],
+  "name": "edge-cloudflare-tunnel TAC"
+}

package/rcf/test-suites/ts-052.json

@@ -3,18 +3,68 @@
   "updatedAt": "2026-09-05T01:30:00.000Z",
   "purpose": "Cover AC-2301-1..7 via unit tests over the shipped application-admin-console blueprint.json contribution shape (23 contributions in 6 REQ / 9 US / 4 TAC / 4 ADR groups), the requiresAppliedCapabilities and elicits[] declarations, the pack-loader accepting the shipped pack file with every check id cross-checked against blueprint AC ids, the pack appliesTo predicate discipline (references BOTH tacIds and route), the sample-app fixture serving the console shell with the ARIA APG grid permission matrix, the CAPS switch surface selector, the users directory, org switcher, audit-log table with correlation id, access-denied and request-access control, and the negative-run behaviour on the ?break=matrix-grid, ?break=denied and ?break=audit-fields switches.",
   "testLevel": "unit",
-  "acIds": ["AC-2301-1", "AC-2301-2", "AC-2301-3", "AC-2301-4", "AC-2301-5", "AC-2301-6", "AC-2301-7"],
+  "acIds": [
+    "AC-2301-1",
+    "AC-2301-2",
+    "AC-2301-3",
+    "AC-2301-4",
+    "AC-2301-5",
+    "AC-2301-6",
+    "AC-2301-7"
+  ],
   "id": "TS-052",
   "usId": "US-2301",
   "title": "application-admin-console v1.0.0 shelf shape, capability discovery, probe pack cross-check and sample-app fixture",
   "testCases": [
-    {"id": "TC-052-blueprint-json-shape", "acId": "AC-2301-1", "description": "blueprint.json declares 23 contributions with requiresAppliedCapabilities and elicits[]", "status": "pending", "testPointer": "test/blueprint/application-admin-console-anatomy.test.js::blueprint.json declares 23 contributions with requiresAppliedCapabilities and elicits[] (TC-052-blueprint-json-shape)"},
-    {"id": "TC-052-applies-clean-with-override", "acId": "AC-2301-2", "description": "Fresh init project applies admin-console --allow-no-auth-yet and writes sidecar with allowNoAuthYet true", "status": "pending", "testPointer": "test/blueprint/application-admin-console-anatomy.test.js::apply --allow-no-auth-yet on bare SPA writes sidecar with allowNoAuthYet:true and empty appliedCapabilities (TC-052-applies-clean-with-override)"},
-    {"id": "TC-052-refuses-bare-spa", "acId": "AC-2301-3", "description": "Fresh init project without auth refuses admin-console apply with exit 3 and spec 5.5.1 message", "status": "pending", "testPointer": "test/blueprint/application-admin-console-anatomy.test.js::apply refuses on bare SPA with spec 5.5.1 verbatim message and lists applied blueprints (TC-052-refuses-bare-spa)"},
-    {"id": "TC-052-capability-discovery", "acId": "AC-2301-4", "description": "Discovery reads applied capabilities from applied blueprints", "status": "pending", "testPointer": "test/blueprint/application-admin-console-anatomy.test.js::apply on magic-link project yields [principalDirectory] and on clerk+logging project yields [principalDirectory,roleModel,auditLog] (TC-052-capability-discovery)"},
-    {"id": "TC-052-pack-checks-cross-check", "acId": "AC-2301-5", "description": "Every pack check id matches contributed AC id and applies gates on capability", "status": "pending", "testPointer": "test/blueprint/application-admin-console-anatomy.test.js::every pack check id matches a contributed AC id and appliesTo predicate gates on the applied capability (TC-052-pack-checks-cross-check)"},
-    {"id": "TC-052-fixture-surfaces", "acId": "AC-2301-6", "description": "Sample-app fixture serves the console shell with grid matrix and required data attributes", "status": "pending", "testPointer": "test/blueprint/application-admin-console-anatomy.test.js::sample-app fixture serves console shell with ARIA APG grid permission matrix and required data attributes (TC-052-fixture-surfaces)"},
-    {"id": "TC-052-negative-runs", "acId": "AC-2301-7", "description": "Break switches surface the three defects on the DOM", "status": "pending", "testPointer": "test/blueprint/application-admin-console-anatomy.test.js::sample-app fixture break switches surface the three defects on the DOM (TC-052-negative-runs)"}
+    {
+      "id": "TC-052-blueprint-json-shape",
+      "acId": "AC-2301-1",
+      "description": "blueprint.json declares 23 contributions with requiresAppliedCapabilities and elicits[]",
+      "status": "pending",
+      "testPointer": "test/blueprint/application-admin-console-anatomy.test.js::blueprint.json declares 28 contributions with requiresAppliedCapabilities and elicits[] (TC-052-blueprint-json-shape)"
+    },
+    {
+      "id": "TC-052-applies-clean-with-override",
+      "acId": "AC-2301-2",
+      "description": "Fresh init project applies admin-console --allow-no-auth-yet and writes sidecar with allowNoAuthYet true",
+      "status": "pending",
+      "testPointer": "test/blueprint/application-admin-console-anatomy.test.js::apply --allow-no-auth-yet on bare SPA writes sidecar with allowNoAuthYet:true and empty appliedCapabilities (TC-052-applies-clean-with-override)"
+    },
+    {
+      "id": "TC-052-refuses-bare-spa",
+      "acId": "AC-2301-3",
+      "description": "Fresh init project without auth refuses admin-console apply with exit 3 and spec 5.5.1 message",
+      "status": "pending",
+      "testPointer": "test/blueprint/application-admin-console-anatomy.test.js::apply refuses on bare SPA with spec 5.5.1 verbatim message and lists applied blueprints (TC-052-refuses-bare-spa)"
+    },
+    {
+      "id": "TC-052-capability-discovery",
+      "acId": "AC-2301-4",
+      "description": "Discovery reads applied capabilities from applied blueprints",
+      "status": "pending",
+      "testPointer": "test/blueprint/application-admin-console-anatomy.test.js::apply on magic-link project yields [principalDirectory] and on clerk+logging project yields [principalDirectory,roleModel,auditLog] (TC-052-capability-discovery)"
+    },
+    {
+      "id": "TC-052-pack-checks-cross-check",
+      "acId": "AC-2301-5",
+      "description": "Every pack check id matches contributed AC id and applies gates on capability",
+      "status": "pending",
+      "testPointer": "test/blueprint/application-admin-console-anatomy.test.js::every pack check id matches a contributed AC id and appliesTo predicate gates on the applied capability (TC-052-pack-checks-cross-check)"
+    },
+    {
+      "id": "TC-052-fixture-surfaces",
+      "acId": "AC-2301-6",
+      "description": "Sample-app fixture serves the console shell with grid matrix and required data attributes",
+      "status": "pending",
+      "testPointer": "test/blueprint/application-admin-console-anatomy.test.js::sample-app fixture serves console shell with ARIA APG grid permission matrix and required data attributes (TC-052-fixture-surfaces)"
+    },
+    {
+      "id": "TC-052-negative-runs",
+      "acId": "AC-2301-7",
+      "description": "Break switches surface the three defects on the DOM",
+      "status": "pending",
+      "testPointer": "test/blueprint/application-admin-console-anatomy.test.js::sample-app fixture break switches surface the three defects on the DOM (TC-052-negative-runs)"
+    }
   ],
   "status": "draft"
 }

package/rcf/test-suites/ts-080.json

@@ -0,0 +1,22 @@
+{
+  "createdAt": "2026-09-07T10:20:31.862Z",
+  "updatedAt": "2026-09-07T10:21:00.649Z",
+  "purpose": "Cover AC-5001-1 via anatomy test: the shipped kv-facade module's ready() call opens against the KV binding and emits facadeReady with the metadata-only payload",
+  "testLevel": "unit",
+  "acIds": [
+    "AC-5001-1"
+  ],
+  "id": "TS-080",
+  "usId": "US-5001",
+  "title": "T-1 facade opens on boot and emits facadeReady",
+  "testCases": [
+    {
+      "id": "TC-080-ac-5001-1-facade-ready",
+      "acId": "AC-5001-1",
+      "description": "Cover AC-5001-1 via anatomy test: kv-facade.mjs ready() call emits facadeReady with metadata-only payload",
+      "status": "pending",
+      "testPointer": "test/blueprint/platform-cloudflare-kv-anatomy.test.js::facade opens on boot and emits facadeReady with metadata-only payload (TC-080-facade-ready)"
+    }
+  ],
+  "status": "draft"
+}

package/rcf/test-suites/ts-081.json

@@ -0,0 +1,22 @@
+{
+  "createdAt": "2026-09-07T10:20:32.039Z",
+  "updatedAt": "2026-09-07T10:21:00.826Z",
+  "purpose": "Cover AC-5002-1 via anatomy test: a grep on the cf-platform fixture src/ tree for env.CACHE returns exactly src/kv-facade.mjs",
+  "testLevel": "unit",
+  "acIds": [
+    "AC-5002-1"
+  ],
+  "id": "TS-081",
+  "usId": "US-5002",
+  "title": "T-1 KV binding sole-reader grep on the applied fixture",
+  "testCases": [
+    {
+      "id": "TC-081-ac-5002-1-sole-reader",
+      "acId": "AC-5002-1",
+      "description": "Cover AC-5002-1 via anatomy test: grep for env.CACHE in cf-platform src/ returns exactly src/kv-facade.mjs",
+      "status": "pending",
+      "testPointer": "test/blueprint/platform-cloudflare-kv-anatomy.test.js::env.CACHE binding is dereferenced in exactly one fixture source file (TC-081-sole-reader)"
+    }
+  ],
+  "status": "draft"
+}

package/rcf/test-suites/ts-082.json

@@ -0,0 +1,30 @@
+{
+  "createdAt": "2026-09-07T10:20:32.213Z",
+  "updatedAt": "2026-09-07T10:21:01.181Z",
+  "purpose": "Cover AC-5101-1 and AC-5101-2 via facade-round-trip probe run and anatomy test cross-check",
+  "testLevel": "unit",
+  "acIds": [
+    "AC-5101-1",
+    "AC-5101-2"
+  ],
+  "id": "TS-082",
+  "usId": "US-5101",
+  "title": "T-1 facade round-trip put get delete via in-memory KV driver",
+  "testCases": [
+    {
+      "id": "TC-082-ac-5101-1-round-trip",
+      "acId": "AC-5101-1",
+      "description": "Cover AC-5101-1 via facade-round-trip probe run and anatomy report cross-check",
+      "status": "pending",
+      "testPointer": "test/blueprint/platform-cloudflare-kv-anatomy.test.js::facade-round-trip probe passes on the fixture kv-driver (TC-082-round-trip)"
+    },
+    {
+      "id": "TC-082-ac-5101-2-delete-then-null",
+      "acId": "AC-5101-2",
+      "description": "Cover AC-5101-2 via facade-round-trip probe: delete then get returns null and emits kvMiss",
+      "status": "pending",
+      "testPointer": "test/blueprint/platform-cloudflare-kv-anatomy.test.js::facade-round-trip probe verifies delete-then-null branch (TC-082-delete-null)"
+    }
+  ],
+  "status": "draft"
+}