rcf-lite 0.23.0 → 0.25.0

package/rcf/test-suites/ts-114.json

@@ -0,0 +1,22 @@
+{
+  "createdAt": "2026-09-07T16:52:18.782Z",
+  "updatedAt": "2026-09-07T16:53:11.523Z",
+  "purpose": "Cover AC-8201-1 via anatomy test: guide file greps for both section headings, curl example, and vendor URL",
+  "testLevel": "unit",
+  "acIds": [
+    "AC-8201-1"
+  ],
+  "id": "TS-114",
+  "usId": "US-8201",
+  "title": "T-4 policy issuance guide: dashboard walk-through and API alternative documented",
+  "testCases": [
+    {
+      "id": "TC-114-guide-policy-issuance",
+      "acId": "AC-8201-1",
+      "description": "AC-8201-1 anatomy proof",
+      "status": "pending",
+      "testPointer": "test/blueprint/edge-cloudflare-access-anatomy.test.js::guide carries dashboard walk-through and API alternative with vendor URL (TC-114-guide-policy-issuance)"
+    }
+  ],
+  "status": "draft"
+}

package/rcf/test-suites/ts-115.json

@@ -0,0 +1,22 @@
+{
+  "createdAt": "2026-09-07T16:52:18.965Z",
+  "updatedAt": "2026-09-07T16:53:11.708Z",
+  "purpose": "Cover AC-8301-1 via anatomy test: driver runs the validator 10 times and asserts sink shape",
+  "testLevel": "unit",
+  "acIds": [
+    "AC-8301-1"
+  ],
+  "id": "TS-115",
+  "usId": "US-8301",
+  "title": "T-4 audit metadata secrecy: 10 records after 5+5 runs, no forbidden substrings",
+  "testCases": [
+    {
+      "id": "TC-115-audit-metadata-secrecy",
+      "acId": "AC-8301-1",
+      "description": "AC-8301-1 anatomy proof",
+      "status": "pending",
+      "testPointer": "test/blueprint/edge-cloudflare-access-anatomy.test.js::audit sink after 5 pass 5 reject holds 10 metadata-only records with no forbidden substrings (TC-115-audit-metadata-secrecy)"
+    }
+  ],
+  "status": "draft"
+}

package/rcf/test-suites/ts-116.json

@@ -0,0 +1,22 @@
+{
+  "createdAt": "2026-09-07T16:52:19.149Z",
+  "updatedAt": "2026-09-07T16:53:11.893Z",
+  "purpose": "Cover AC-8401-1 via anatomy test: paired headers observed, principal service:<id>, audit outcome=bypass with allowed keys",
+  "testLevel": "unit",
+  "acIds": [
+    "AC-8401-1"
+  ],
+  "id": "TS-116",
+  "usId": "US-8401",
+  "title": "T-4 break-glass posture: bypass-service-auth pair authenticates and audits as outcome=bypass",
+  "testCases": [
+    {
+      "id": "TC-116-break-glass-bypass",
+      "acId": "AC-8401-1",
+      "description": "AC-8401-1 anatomy proof",
+      "status": "pending",
+      "testPointer": "test/blueprint/edge-cloudflare-access-anatomy.test.js::break-glass bypass-service-auth pair authenticates and audits outcome bypass with allowed keys (TC-116-break-glass-bypass)"
+    }
+  ],
+  "status": "draft"
+}

package/rcf/test-suites/ts-117.json

@@ -0,0 +1,22 @@
+{
+  "createdAt": "2026-09-07T16:52:19.333Z",
+  "updatedAt": "2026-09-07T16:53:12.077Z",
+  "purpose": "Cover AC-8501-1 via anatomy test: extended admin-console fixture DOM inspection on both caps combinations",
+  "testLevel": "unit",
+  "acIds": [
+    "AC-8501-1"
+  ],
+  "id": "TS-117",
+  "usId": "US-8501",
+  "title": "T-4 admin-console composition: sign-in surface flips per applied capability set",
+  "testCases": [
+    {
+      "id": "TC-117-admin-console-gate-surface",
+      "acId": "AC-8501-1",
+      "description": "AC-8501-1 anatomy proof",
+      "status": "pending",
+      "testPointer": "test/blueprint/edge-cloudflare-access-anatomy.test.js::extended admin-console pack fixture flips sign-in surface per applied capability set (TC-117-admin-console-gate-surface)"
+    }
+  ],
+  "status": "draft"
+}

package/rcf/test-suites/ts-118.json

@@ -0,0 +1,22 @@
+{
+  "createdAt": "2026-09-07T16:52:19.533Z",
+  "updatedAt": "2026-09-07T16:53:12.260Z",
+  "purpose": "Cover AC-8601-1 via anatomy test: gated caps combination renders access-gated surface and no local-login",
+  "testLevel": "unit",
+  "acIds": [
+    "AC-8601-1"
+  ],
+  "id": "TS-118",
+  "usId": "US-8601",
+  "title": "T-4 admin-console v1.1.0 Access-gated surface: pack check AC-21815-1 fires on gated fixture",
+  "testCases": [
+    {
+      "id": "TC-118-admin-console-gated-pack-check",
+      "acId": "AC-8601-1",
+      "description": "AC-8601-1 anatomy proof",
+      "status": "pending",
+      "testPointer": "test/blueprint/edge-cloudflare-access-anatomy.test.js::admin-console v1_1_0 pack check AC-21815-1 fires on gated caps combination (TC-118-admin-console-gated-pack-check)"
+    }
+  ],
+  "status": "draft"
+}

package/rcf/test-suites/ts-119.json

@@ -0,0 +1,30 @@
+{
+  "createdAt": "2026-09-07T16:52:19.718Z",
+  "updatedAt": "2026-09-07T16:53:12.816Z",
+  "purpose": "Cover AC-8602-1 via anatomy test: non-gated caps combination renders local-login and no access-gated",
+  "testLevel": "unit",
+  "acIds": [
+    "AC-8602-1",
+    "AC-8502-1"
+  ],
+  "id": "TS-119",
+  "usId": "US-8602",
+  "title": "T-4 admin-console v1.1.0 fallback: local-login surface renders without zeroTrustGate",
+  "testCases": [
+    {
+      "id": "TC-119-admin-console-fallback",
+      "acId": "AC-8602-1",
+      "description": "AC-8602-1 anatomy proof",
+      "status": "pending",
+      "testPointer": "test/blueprint/edge-cloudflare-access-anatomy.test.js::admin-console v1_1_0 renders local-login surface on the non-gated caps combination (TC-119-admin-console-fallback)"
+    },
+    {
+      "id": "TC-119-real-account-gated-url-skipped",
+      "acId": "AC-8502-1",
+      "description": "AC-8502-1 anatomy proof under real-account probe module and shim (accountBoundSkipped path in unit)",
+      "status": "pending",
+      "testPointer": "test/blueprint/edge-cloudflare-access-anatomy.test.js::real-account-gated-url probe records accountBoundSkipped when env vars absent (TC-119-real-account-gated-url-skipped)"
+    }
+  ],
+  "status": "draft"
+}

package/rcf/test-suites/ts-120.json

@@ -0,0 +1,22 @@
+{
+  "createdAt": "2026-09-07T19:56:40.460Z",
+  "updatedAt": "2026-09-07T19:56:40.645Z",
+  "purpose": "Cover AC-9001-1 via anatomy test: pack fixture renders Turnstile widget with always-pass sitekey; iframe origin Cloudflare only; no third-party script; hidden Cf-Turnstile-Response token populates on submit",
+  "testLevel": "integration",
+  "acIds": [
+    "AC-9001-1"
+  ],
+  "id": "TS-120",
+  "usId": "US-9001",
+  "title": "T-5 AC-9001-1 anatomy proof",
+  "testCases": [
+    {
+      "id": "TC-120-widget-mount-pass",
+      "acId": "AC-9001-1",
+      "description": "AC-9001-1 anatomy proof",
+      "status": "pending",
+      "testPointer": "test/blueprint/edge-cloudflare-turnstile-anatomy.test.js::widget mount fixture renders the Turnstile iframe from Cloudflare origin only and populates the token on submit (TC-120-widget-mount-pass)"
+    }
+  ],
+  "status": "draft"
+}

package/rcf/test-suites/ts-121.json

@@ -0,0 +1,22 @@
+{
+  "createdAt": "2026-09-07T19:56:40.831Z",
+  "updatedAt": "2026-09-07T19:56:41.018Z",
+  "purpose": "Cover AC-9002-1 via anatomy test: secret-shape source-tree scan reports zero inline literals; every TURNSTILE_SECRET read is env-shaped",
+  "testLevel": "unit",
+  "acIds": [
+    "AC-9002-1"
+  ],
+  "id": "TS-121",
+  "usId": "US-9002",
+  "title": "T-5 AC-9002-1 anatomy proof",
+  "testCases": [
+    {
+      "id": "TC-121-secret-shape-scan",
+      "acId": "AC-9002-1",
+      "description": "AC-9002-1 anatomy proof",
+      "status": "pending",
+      "testPointer": "test/blueprint/edge-cloudflare-turnstile-anatomy.test.js::secret-shape scan reports env-shaped reads only and no inline literals in the pack fixture (TC-121-secret-shape-scan)"
+    }
+  ],
+  "status": "draft"
+}

package/rcf/test-suites/ts-122.json

@@ -0,0 +1,22 @@
+{
+  "createdAt": "2026-09-07T19:56:41.203Z",
+  "updatedAt": "2026-09-07T19:56:41.407Z",
+  "purpose": "Cover AC-9101-1 via anatomy test: live POST to Cloudflare siteverify endpoint with pinned always-pass secret returns success:true; handler responds 200",
+  "testLevel": "integration",
+  "acIds": [
+    "AC-9101-1"
+  ],
+  "id": "TS-122",
+  "usId": "US-9101",
+  "title": "T-5 AC-9101-1 anatomy proof",
+  "testCases": [
+    {
+      "id": "TC-122-siteverify-pass",
+      "acId": "AC-9101-1",
+      "description": "AC-9101-1 anatomy proof",
+      "status": "pending",
+      "testPointer": "test/blueprint/edge-cloudflare-turnstile-anatomy.test.js::siteverify pass posts to Cloudflare with the always-pass secret and returns success true (TC-122-siteverify-pass)"
+    }
+  ],
+  "status": "draft"
+}

package/rcf/test-suites/ts-123.json

@@ -0,0 +1,22 @@
+{
+  "createdAt": "2026-09-07T19:56:41.594Z",
+  "updatedAt": "2026-09-07T19:56:41.779Z",
+  "purpose": "Cover AC-9102-1 via anatomy test: live POST to Cloudflare siteverify endpoint with pinned always-fail secret returns success:false; handler responds 400; event records shape carries no token or secret",
+  "testLevel": "integration",
+  "acIds": [
+    "AC-9102-1"
+  ],
+  "id": "TS-123",
+  "usId": "US-9102",
+  "title": "T-5 AC-9102-1 anatomy proof",
+  "testCases": [
+    {
+      "id": "TC-123-siteverify-fail-secrecy",
+      "acId": "AC-9102-1",
+      "description": "AC-9102-1 anatomy proof",
+      "status": "pending",
+      "testPointer": "test/blueprint/edge-cloudflare-turnstile-anatomy.test.js::siteverify fail returns success false and event records carry sitekeyHash outcome and timestamp only (TC-123-siteverify-fail-secrecy)"
+    }
+  ],
+  "status": "draft"
+}

package/rcf/test-suites/ts-124.json

@@ -0,0 +1,22 @@
+{
+  "createdAt": "2026-09-07T19:56:41.965Z",
+  "updatedAt": "2026-09-07T19:56:42.150Z",
+  "purpose": "Cover AC-9201-1 via anatomy test: guard-shape source-tree scan asserts every elicited surface carries a token-required guard; a missing-token submit is refused with 400 by the pack fixture",
+  "testLevel": "integration",
+  "acIds": [
+    "AC-9201-1"
+  ],
+  "id": "TS-124",
+  "usId": "US-9201",
+  "title": "T-5 AC-9201-1 anatomy proof",
+  "testCases": [
+    {
+      "id": "TC-124-guard-shape-refuse",
+      "acId": "AC-9201-1",
+      "description": "AC-9201-1 anatomy proof",
+      "status": "pending",
+      "testPointer": "test/blueprint/edge-cloudflare-turnstile-anatomy.test.js::guard shape scan and pack-fixture missing-token submit refuses with 400 (TC-124-guard-shape-refuse)"
+    }
+  ],
+  "status": "draft"
+}

package/rcf/test-suites/ts-125.json

@@ -0,0 +1,22 @@
+{
+  "createdAt": "2026-09-07T19:56:42.335Z",
+  "updatedAt": "2026-09-07T19:56:42.521Z",
+  "purpose": "Cover AC-9301-1 via anatomy test: composition contract is realised in the pack fixture magic-link mint route; the mint reads the Turnstile guard before invoking the mint",
+  "testLevel": "unit",
+  "acIds": [
+    "AC-9301-1"
+  ],
+  "id": "TS-125",
+  "usId": "US-9301",
+  "title": "T-5 AC-9301-1 anatomy proof",
+  "testCases": [
+    {
+      "id": "TC-125-composition-wire",
+      "acId": "AC-9301-1",
+      "description": "AC-9301-1 anatomy proof",
+      "status": "pending",
+      "testPointer": "test/blueprint/edge-cloudflare-turnstile-anatomy.test.js::composition wire on the pack fixture magic-link mint reads the Turnstile guard first (TC-125-composition-wire)"
+    }
+  ],
+  "status": "draft"
+}

package/rcf/test-suites/ts-126.json

@@ -0,0 +1,22 @@
+{
+  "createdAt": "2026-09-07T19:56:42.706Z",
+  "updatedAt": "2026-09-07T19:56:42.891Z",
+  "purpose": "Cover AC-9302-1 via anatomy test: magic-link mint refusal on missing and on always-fail token; no mint fires",
+  "testLevel": "integration",
+  "acIds": [
+    "AC-9302-1"
+  ],
+  "id": "TS-126",
+  "usId": "US-9302",
+  "title": "T-5 AC-9302-1 anatomy proof",
+  "testCases": [
+    {
+      "id": "TC-126-magic-link-guard-refuse",
+      "acId": "AC-9302-1",
+      "description": "AC-9302-1 anatomy proof",
+      "status": "pending",
+      "testPointer": "test/blueprint/edge-cloudflare-turnstile-anatomy.test.js::magic-link mint route refuses on missing token and on always-fail token (TC-126-magic-link-guard-refuse)"
+    }
+  ],
+  "status": "draft"
+}

package/rcf/test-suites/ts-127.json

@@ -0,0 +1,22 @@
+{
+  "createdAt": "2026-09-07T19:56:43.076Z",
+  "updatedAt": "2026-09-07T19:56:43.260Z",
+  "purpose": "Cover AC-9401-1 via anatomy test: pack fixture accepts mode=managed, mode=non-interactive and mode=invisible and each renders with a Cloudflare-origin iframe only",
+  "testLevel": "integration",
+  "acIds": [
+    "AC-9401-1"
+  ],
+  "id": "TS-127",
+  "usId": "US-9401",
+  "title": "T-5 AC-9401-1 anatomy proof",
+  "testCases": [
+    {
+      "id": "TC-127-widget-mode-enum",
+      "acId": "AC-9401-1",
+      "description": "AC-9401-1 anatomy proof",
+      "status": "pending",
+      "testPointer": "test/blueprint/edge-cloudflare-turnstile-anatomy.test.js::widget mode enum honours managed non-interactive and invisible on the pack fixture (TC-127-widget-mode-enum)"
+    }
+  ],
+  "status": "draft"
+}

package/rcf/test-suites/ts-130.json

@@ -0,0 +1,22 @@
+{
+  "createdAt": "2026-09-07T21:41:27.755Z",
+  "updatedAt": "2026-09-07T21:41:28.044Z",
+  "purpose": "Cover AC-10001-1 via the T-6 anatomy test in test/blueprint/edge-cloudflare-rate-limiting-anatomy.test.js.",
+  "testLevel": "integration",
+  "acIds": [
+    "AC-10001-1"
+  ],
+  "id": "TS-130",
+  "usId": "US-10001",
+  "title": "T-6 AC-10001-1 anatomy proof",
+  "testCases": [
+    {
+      "id": "TC-130-manifest-presence-pass",
+      "acId": "AC-10001-1",
+      "description": "AC-10001-1 anatomy proof (T-6 rate-limiting slice, TC-130-manifest-presence-pass)",
+      "status": "pending",
+      "testPointer": "test/blueprint/edge-cloudflare-rate-limiting-anatomy.test.js::T-6 rate-limiting AC-10001-1 anatomy proof (TC-130-manifest-presence-pass)"
+    }
+  ],
+  "status": "draft"
+}

package/rcf/test-suites/ts-131.json

@@ -0,0 +1,22 @@
+{
+  "createdAt": "2026-09-07T21:41:28.334Z",
+  "updatedAt": "2026-09-07T21:41:28.623Z",
+  "purpose": "Cover AC-10101-1 via the T-6 anatomy test in test/blueprint/edge-cloudflare-rate-limiting-anatomy.test.js.",
+  "testLevel": "integration",
+  "acIds": [
+    "AC-10101-1"
+  ],
+  "id": "TS-131",
+  "usId": "US-10101",
+  "title": "T-6 AC-10101-1 anatomy proof",
+  "testCases": [
+    {
+      "id": "TC-131-guide-management-surface-doc",
+      "acId": "AC-10101-1",
+      "description": "AC-10101-1 anatomy proof (T-6 rate-limiting slice, TC-131-guide-management-surface-doc)",
+      "status": "pending",
+      "testPointer": "test/blueprint/edge-cloudflare-rate-limiting-anatomy.test.js::T-6 rate-limiting AC-10101-1 anatomy proof (TC-131-guide-management-surface-doc)"
+    }
+  ],
+  "status": "draft"
+}

package/rcf/test-suites/ts-132.json

@@ -0,0 +1,22 @@
+{
+  "createdAt": "2026-09-07T21:41:28.913Z",
+  "updatedAt": "2026-09-07T21:41:29.200Z",
+  "purpose": "Cover AC-10201-1 via the T-6 anatomy test in test/blueprint/edge-cloudflare-rate-limiting-anatomy.test.js.",
+  "testLevel": "integration",
+  "acIds": [
+    "AC-10201-1"
+  ],
+  "id": "TS-132",
+  "usId": "US-10201",
+  "title": "T-6 AC-10201-1 anatomy proof",
+  "testCases": [
+    {
+      "id": "TC-132-real-account-burst-and-429-or-skipped",
+      "acId": "AC-10201-1",
+      "description": "AC-10201-1 anatomy proof (T-6 rate-limiting slice, TC-132-real-account-burst-and-429-or-skipped)",
+      "status": "pending",
+      "testPointer": "test/blueprint/edge-cloudflare-rate-limiting-anatomy.test.js::T-6 rate-limiting AC-10201-1 anatomy proof (TC-132-real-account-burst-and-429-or-skipped)"
+    }
+  ],
+  "status": "draft"
+}

package/rcf/test-suites/ts-133.json

@@ -0,0 +1,22 @@
+{
+  "createdAt": "2026-09-07T21:41:29.506Z",
+  "updatedAt": "2026-09-07T21:41:29.793Z",
+  "purpose": "Cover AC-10301-1 via the T-6 anatomy test in test/blueprint/edge-cloudflare-rate-limiting-anatomy.test.js.",
+  "testLevel": "integration",
+  "acIds": [
+    "AC-10301-1"
+  ],
+  "id": "TS-133",
+  "usId": "US-10301",
+  "title": "T-6 AC-10301-1 anatomy proof",
+  "testCases": [
+    {
+      "id": "TC-133-drift-audit-runner-diff",
+      "acId": "AC-10301-1",
+      "description": "AC-10301-1 anatomy proof (T-6 rate-limiting slice, TC-133-drift-audit-runner-diff)",
+      "status": "pending",
+      "testPointer": "test/blueprint/edge-cloudflare-rate-limiting-anatomy.test.js::T-6 rate-limiting AC-10301-1 anatomy proof (TC-133-drift-audit-runner-diff)"
+    }
+  ],
+  "status": "draft"
+}

package/rcf/test-suites/ts-134.json

@@ -0,0 +1,22 @@
+{
+  "createdAt": "2026-09-07T21:41:30.086Z",
+  "updatedAt": "2026-09-07T21:41:30.375Z",
+  "purpose": "Cover AC-10401-1 via the T-6 anatomy test in test/blueprint/edge-cloudflare-rate-limiting-anatomy.test.js.",
+  "testLevel": "integration",
+  "acIds": [
+    "AC-10401-1"
+  ],
+  "id": "TS-134",
+  "usId": "US-10401",
+  "title": "T-6 AC-10401-1 anatomy proof",
+  "testCases": [
+    {
+      "id": "TC-134-composition-guide-section",
+      "acId": "AC-10401-1",
+      "description": "AC-10401-1 anatomy proof (T-6 rate-limiting slice, TC-134-composition-guide-section)",
+      "status": "pending",
+      "testPointer": "test/blueprint/edge-cloudflare-rate-limiting-anatomy.test.js::T-6 rate-limiting AC-10401-1 anatomy proof (TC-134-composition-guide-section)"
+    }
+  ],
+  "status": "draft"
+}

package/rcf/test-suites/ts-135.json

@@ -0,0 +1,22 @@
+{
+  "createdAt": "2026-09-07T21:41:30.663Z",
+  "updatedAt": "2026-09-07T21:41:30.952Z",
+  "purpose": "Cover AC-10601-1 via the T-6 anatomy test in test/blueprint/edge-cloudflare-rate-limiting-anatomy.test.js.",
+  "testLevel": "integration",
+  "acIds": [
+    "AC-10601-1"
+  ],
+  "id": "TS-135",
+  "usId": "US-10601",
+  "title": "T-6 AC-10601-1 anatomy proof",
+  "testCases": [
+    {
+      "id": "TC-135-manifest-schema-validate-pass-and-fail",
+      "acId": "AC-10601-1",
+      "description": "AC-10601-1 anatomy proof (T-6 rate-limiting slice, TC-135-manifest-schema-validate-pass-and-fail)",
+      "status": "pending",
+      "testPointer": "test/blueprint/edge-cloudflare-rate-limiting-anatomy.test.js::T-6 rate-limiting AC-10601-1 anatomy proof (TC-135-manifest-schema-validate-pass-and-fail)"
+    }
+  ],
+  "status": "draft"
+}

package/rcf/test-suites/ts-136.json

@@ -0,0 +1,22 @@
+{
+  "createdAt": "2026-09-07T21:41:31.243Z",
+  "updatedAt": "2026-09-07T21:41:31.532Z",
+  "purpose": "Cover AC-10701-1 via the T-6 anatomy test in test/blueprint/edge-cloudflare-rate-limiting-anatomy.test.js.",
+  "testLevel": "integration",
+  "acIds": [
+    "AC-10701-1"
+  ],
+  "id": "TS-136",
+  "usId": "US-10701",
+  "title": "T-6 AC-10701-1 anatomy proof",
+  "testCases": [
+    {
+      "id": "TC-136-event-secrecy-pass-and-leak",
+      "acId": "AC-10701-1",
+      "description": "AC-10701-1 anatomy proof (T-6 rate-limiting slice, TC-136-event-secrecy-pass-and-leak)",
+      "status": "pending",
+      "testPointer": "test/blueprint/edge-cloudflare-rate-limiting-anatomy.test.js::T-6 rate-limiting AC-10701-1 anatomy proof (TC-136-event-secrecy-pass-and-leak)"
+    }
+  ],
+  "status": "draft"
+}

package/rcf/test-suites/ts-137.json

@@ -0,0 +1,22 @@
+{
+  "createdAt": "2026-09-07T21:41:31.821Z",
+  "updatedAt": "2026-09-07T21:41:32.111Z",
+  "purpose": "Cover AC-10801-1 via the T-6 anatomy test in test/blueprint/edge-cloudflare-rate-limiting-anatomy.test.js.",
+  "testLevel": "integration",
+  "acIds": [
+    "AC-10801-1"
+  ],
+  "id": "TS-137",
+  "usId": "US-10801",
+  "title": "T-6 AC-10801-1 anatomy proof",
+  "testCases": [
+    {
+      "id": "TC-137-manifest-presence-missing-fail",
+      "acId": "AC-10801-1",
+      "description": "AC-10801-1 anatomy proof (T-6 rate-limiting slice, TC-137-manifest-presence-missing-fail)",
+      "status": "pending",
+      "testPointer": "test/blueprint/edge-cloudflare-rate-limiting-anatomy.test.js::T-6 rate-limiting AC-10801-1 anatomy proof (TC-137-manifest-presence-missing-fail)"
+    }
+  ],
+  "status": "draft"
+}

package/rcf/test-suites/ts-140.json

@@ -0,0 +1,86 @@
+{
+  "createdAt": "2026-09-07T23:57:26.071Z",
+  "updatedAt": "2026-09-07T23:58:51.258Z",
+  "purpose": "Cover the T-1 chain ACs via the shipped anatomy test at test/blueprint/deploy-hetzner-server-anatomy.test.js and via the six blueprint probes driven from the shared throwaway-server fixture",
+  "testLevel": "integration",
+  "acIds": [
+    "AC-11001-1",
+    "AC-11101-1",
+    "AC-11102-1",
+    "AC-11201-1",
+    "AC-11202-1",
+    "AC-11301-1",
+    "AC-11401-1",
+    "AC-11402-1",
+    "AC-11501-1"
+  ],
+  "id": "TS-140",
+  "usId": "US-11001",
+  "title": "T-1 hetzner-server anatomy proof: probe modules and mocked fixture assertions",
+  "testCases": [
+    {
+      "id": "TC-140-provisioner-boot-and-sole-reader",
+      "acId": "AC-11001-1",
+      "description": "Cover AC-11001-1 via anatomy test: provisioner facade boot emits provisionerReady with metadata-only payload and only the facade reads the token",
+      "status": "pending",
+      "testPointer": "test/blueprint/deploy-hetzner-server-anatomy.test.js::T-1 deploy-hetzner-server AC-11001-1 provisioner boot and sole reader (TC-140)"
+    },
+    {
+      "id": "TC-140-manifest-schema-shape-valid",
+      "acId": "AC-11101-1",
+      "description": "Cover AC-11101-1 via anatomy test: hetzner-server.schema.json validates the fixture manifests",
+      "status": "pending",
+      "testPointer": "test/blueprint/deploy-hetzner-server-anatomy.test.js::T-1 deploy-hetzner-server AC-11101-1 manifest schema shape valid (TC-140-manifest-schema-shape-valid)"
+    },
+    {
+      "id": "TC-140-manifest-applies-mocked-provision",
+      "acId": "AC-11102-1",
+      "description": "Cover AC-11102-1 via anatomy test: mocked hcloud shell path returns id, primaryIpv4, location, serverType and hetznerServerProvisioned fires",
+      "status": "pending",
+      "testPointer": "test/blueprint/deploy-hetzner-server-anatomy.test.js::T-1 deploy-hetzner-server AC-11102-1 manifest applies to mocked provision (TC-140-manifest-applies-mocked-provision)"
+    },
+    {
+      "id": "TC-140-cloud-init-render-baseline-present",
+      "acId": "AC-11201-1",
+      "description": "Cover AC-11201-1 via anatomy test: rendered cloud-init YAML carries the six baseline blocks",
+      "status": "pending",
+      "testPointer": "test/blueprint/deploy-hetzner-server-anatomy.test.js::T-1 deploy-hetzner-server AC-11201-1 cloud-init render baseline present (TC-140-cloud-init-render-baseline-present)"
+    },
+    {
+      "id": "TC-140-cloud-init-hardened-account-bound-probe",
+      "acId": "AC-11202-1",
+      "description": "Cover AC-11202-1 via anatomy test: probe module manifest declares accountBound true and the fixture readme documents the ssh baseline checks",
+      "status": "pending",
+      "testPointer": "test/blueprint/deploy-hetzner-server-anatomy.test.js::T-1 deploy-hetzner-server AC-11202-1 cloud-init hardened account-bound probe declared (TC-140-cloud-init-hardened-account-bound-probe)"
+    },
+    {
+      "id": "TC-140-firewall-shape-valid-and-refuses-open-ssh",
+      "acId": "AC-11301-1",
+      "description": "Cover AC-11301-1 via anatomy test: schema accepts a rule set with 22 restricted plus 80/443 open and refuses an open-ssh mutation",
+      "status": "pending",
+      "testPointer": "test/blueprint/deploy-hetzner-server-anatomy.test.js::T-1 deploy-hetzner-server AC-11301-1 firewall shape valid and refuses open ssh (TC-140-firewall-shape-valid-and-refuses-open-ssh)"
+    },
+    {
+      "id": "TC-140-snapshot-cadence-enum",
+      "acId": "AC-11401-1",
+      "description": "Cover AC-11401-1 via anatomy test: snapshotCadence enum is weekly, daily, off",
+      "status": "pending",
+      "testPointer": "test/blueprint/deploy-hetzner-server-anatomy.test.js::T-1 deploy-hetzner-server AC-11401-1 snapshot cadence enum (TC-140-snapshot-cadence-enum)"
+    },
+    {
+      "id": "TC-140-snapshot-on-demand-account-bound-probe",
+      "acId": "AC-11402-1",
+      "description": "Cover AC-11402-1 via anatomy test: snapshot on-demand probe declares accountBound true and readme names the hcloud image list check",
+      "status": "pending",
+      "testPointer": "test/blueprint/deploy-hetzner-server-anatomy.test.js::T-1 deploy-hetzner-server AC-11402-1 snapshot on demand account-bound probe declared (TC-140-snapshot-on-demand-account-bound-probe)"
+    },
+    {
+      "id": "TC-140-lifecycle-events-metadata-only",
+      "acId": "AC-11501-1",
+      "description": "Cover AC-11501-1 via anatomy test: hcloud dry-run mock drives four lifecycle events, payloads carry only metadata fields, event-secrecy mutation FAILS",
+      "status": "pending",
+      "testPointer": "test/blueprint/deploy-hetzner-server-anatomy.test.js::T-1 deploy-hetzner-server AC-11501-1 lifecycle events metadata only (TC-140-lifecycle-events-metadata-only)"
+    }
+  ],
+  "status": "draft"
+}