rcf-lite 0.23.0 → 0.25.0

package/rcf/user-stories/us-5401.json

@@ -0,0 +1,27 @@
+{
+  "createdAt": "2026-09-07T10:18:41.795Z",
+  "updatedAt": "2026-09-07T10:20:10.276Z",
+  "usId": "US-5401",
+  "prdId": "PRD-001",
+  "reqId": "REQ-054",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-1 real-account eventual-consistency smoke: write eventually appears on a global read within a bounded 60-second cap or records accountBoundSkipped in CI",
+  "asA": "shelf consumer applying platform-cloudflare-kv v1.0.0 in CI with real Cloudflare credentials",
+  "iWant": "the real-account eventual-consistency smoke to open the facade against a real KV namespace and observe the write eventually appearing on a global read",
+  "soThat": "the applied project has one probe that exercises the real vendor surface (not just the in-memory driver) and closes the mechanism-reach gap between fixture and production",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-5401-1",
+      "description": "When CI_HAS_CLOUDFLARE_ACCOUNT is set (with CF_ACCOUNT_ID, CF_KV_NAMESPACE_ID and CF_API_TOKEN), the real-account probe opens the facade against the real KV namespace via the Workers KV REST API, writes a fixture key, polls the same key with bounded 60-second cap, and asserts the value eventually returns. Without CI_HAS_CLOUDFLARE_ACCOUNT the probe records accountBoundSkipped true and the aggregate flips to pass per spec section 3.5. The probe cleans up its written key on exit.",
+      "given": "the real-account smoke shim with or without CI_HAS_CLOUDFLARE_ACCOUNT",
+      "when": "the shim runs",
+      "then": "with the env var: the write eventually returns within 60 seconds and the aggregate is pass; without: the aggregate is pass and the report records accountBoundSkipped true",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tags": [
+    "blueprint:platform-cloudflare-kv"
+  ]
+}

package/rcf/user-stories/us-6001.json

@@ -0,0 +1,27 @@
+{
+  "createdAt": "2026-09-07T12:28:01.537Z",
+  "updatedAt": "2026-09-07T12:28:01.537Z",
+  "asA": "shelf consumer applying the platform-cloudflare-cron-triggers v1.0.0 blueprint on a Workers project using the cf-platform fixture",
+  "iWant": "one scheduled() handler module (src/scheduled.mjs) that opens against the elicited cron triggers on process boot, wires the dispatcher and event sink, and emits a cronReady lifecycle event with a metadata-only payload",
+  "soThat": "boot ordering is observable, the scheduled seam is a single call site, and the applied project can compose its own bootstrapping around one predictable event",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-6001-1",
+      "description": "On process boot, the scheduled handler binds against the elicited cron triggers (the [triggers] crons block in wrangler.toml on the fixture), wires the dispatcher and the injected event sink, and emits a cronReady event on the sink with a payload of exactly {event, key, size, ttl, timestamp} where key is null, size is 0 and ttl is null. The scheduled handler does NOT dereference the KV binding (env.CACHE stays owned by the T-1 facade).",
+      "given": "a Node or Worker process with the scheduled handler module imported and its factory invoked with the elicited configuration",
+      "when": "the process boots and the scheduled handler ready() call resolves",
+      "then": "a cronReady event fires on the injected event sink with the metadata-only payload; the module does not dereference env.CACHE",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tags": [
+    "blueprint:platform-cloudflare-cron-triggers"
+  ],
+  "usId": "US-6001",
+  "prdId": "PRD-001",
+  "reqId": "REQ-060",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-2 scheduled() handler opens against the elicited cron triggers on boot and emits cronReady"
+}

package/rcf/user-stories/us-6002.json

@@ -0,0 +1,27 @@
+{
+  "createdAt": "2026-09-07T12:28:01.742Z",
+  "updatedAt": "2026-09-07T12:28:01.742Z",
+  "asA": "reviewer verifying the platform-cloudflare-cron-triggers v1.0.0 blueprint at mechanism reach",
+  "iWant": "the wrangler-test-scheduled probe to spawn wrangler dev --test-scheduled on the cf-platform fixture, drive its scheduled-fire route with a cron expression declared in wrangler.toml, assert a cronFired event fires on the sink and wrangler exits cleanly",
+  "soThat": "the shipped scheduled() handler is proven wired to the vendor's CLI seam, not only to an in-process spy",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-6002-1",
+      "description": "The wrangler-test-scheduled probe spawns wrangler dev --test-scheduled from the cf-platform fixture, waits bounded 30 seconds for the CLI to bind, drives its scheduled-fire route with an expression from wrangler.toml's [triggers] crons block, asserts a cronFired event fires on the injected sink with metadata {expression, scheduledTime, outcome, duration}, kills wrangler cleanly on exit, and returns aggregateVerdict: pass. On a shipped wrangler regression that prevents --test-scheduled from binding, the probe returns aggregateVerdict: warn with the observed CLI stderr quoted and the mechanism-reach gap noted, per section 3.1 pass-with-skip conventions.",
+      "given": "wrangler installed as a devDependency on the cf-platform fixture and the [triggers] crons block declared in wrangler.toml",
+      "when": "the probe runs from the fixture directory",
+      "then": "wrangler dev --test-scheduled binds, the scheduled-fire route drives a cronFired event and wrangler exits cleanly",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tags": [
+    "blueprint:platform-cloudflare-cron-triggers"
+  ],
+  "usId": "US-6002",
+  "prdId": "PRD-001",
+  "reqId": "REQ-060",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-2 wrangler dev --test-scheduled fires cronFired on the fixture handler"
+}

package/rcf/user-stories/us-6003.json

@@ -0,0 +1,27 @@
+{
+  "createdAt": "2026-09-07T12:28:01.964Z",
+  "updatedAt": "2026-09-07T12:28:01.964Z",
+  "asA": "operator validating platform-cloudflare-cron-triggers v1.0.0 against a real Cloudflare account",
+  "iWant": "the real-account-scheduled-smoke probe to schedule a per-minute cron on a real Worker, wait bounded 90 seconds and assert cronFired fires at least once",
+  "soThat": "the shipped scheduled() surface is proven against the vendor's global cron scheduler, not only against wrangler dev",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-6003-1",
+      "description": "The real-account-scheduled-smoke probe, when CI_HAS_CLOUDFLARE_ACCOUNT=true and the paired CF_ACCOUNT_ID / CF_WORKER_NAME / CF_API_TOKEN env vars are set, deploys a scheduled Worker with a per-minute cron expression (* * * * *), waits bounded 90 seconds (poll every 5s) for a cronFired event to appear on the Worker's log stream, and returns aggregateVerdict: pass. Without CI_HAS_CLOUDFLARE_ACCOUNT the probe records accountBoundSkipped: true and aggregates to pass per spec section 3.5.",
+      "given": "a real Cloudflare account with the paired env vars, or no such account and CI_HAS_CLOUDFLARE_ACCOUNT unset",
+      "when": "the probe runs",
+      "then": "with the account: cronFired appears within 90s and the probe passes. Without the account: the probe records accountBoundSkipped: true and exits 0.",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tags": [
+    "blueprint:platform-cloudflare-cron-triggers"
+  ],
+  "usId": "US-6003",
+  "prdId": "PRD-001",
+  "reqId": "REQ-060",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-2 real-account live-cron smoke fires cronFired at least once against a real Cloudflare Worker"
+}

package/rcf/user-stories/us-6101.json

@@ -0,0 +1,36 @@
+{
+  "createdAt": "2026-09-07T12:28:02.169Z",
+  "updatedAt": "2026-09-07T12:28:02.169Z",
+  "asA": "developer whose Worker needs to schedule two or more distinct workloads on distinct cron cadences",
+  "iWant": "one dispatcher module (src/dispatcher.mjs) that accepts an ordered map of cron expressions to handler functions and, on every scheduled invocation, routes to the matched handler with a bounded context",
+  "soThat": "one wrangler.toml [triggers] block with multiple cron expressions cleanly maps to distinct handler code paths without hand-rolled conditionals",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-6101-1",
+      "description": "createDispatcher({routes: [{expression, handler}, ...], eventSink}) returns a dispatch(event) function. Calling dispatch({cron: '* * * * *', scheduledTime}) invokes exactly the handler whose expression is '* * * * *' and passes {expression, scheduledTime, sink} to it; no other route's handler is called on that dispatch.",
+      "given": "a dispatcher wired with two routes and two spy handlers",
+      "when": "dispatch is called with a specific expression",
+      "then": "only the matched spy handler is invoked exactly once with the bounded context",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-6101-2",
+      "description": "Calling dispatch({cron: expressionNotInRoutes, scheduledTime}) does NOT invoke any handler, fires a cronUnmatched event on the sink with metadata {expression, scheduledTime, outcome: unmatched, duration: 0} and returns without side effect.",
+      "given": "a dispatcher wired with two routes and two spy handlers",
+      "when": "dispatch is called with an expression not in the routes",
+      "then": "no spy is called, a cronUnmatched event fires, and dispatch returns without side effect",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tags": [
+    "blueprint:platform-cloudflare-cron-triggers"
+  ],
+  "usId": "US-6101",
+  "prdId": "PRD-001",
+  "reqId": "REQ-061",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-2 dispatcher routes multiple cron expressions to distinct handlers by expression match"
+}

package/rcf/user-stories/us-6201.json

@@ -0,0 +1,36 @@
+{
+  "createdAt": "2026-09-07T12:28:02.375Z",
+  "updatedAt": "2026-09-07T12:28:02.375Z",
+  "asA": "operator observing the timeliness of scheduled work on a Worker",
+  "iWant": "the dispatcher to classify every fire against an elicited skew window and record cronSkewed for late fires with the delta",
+  "soThat": "the applied logging companion surfaces cron drift as a first-class signal without every handler having to keep its own clock",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-6201-1",
+      "description": "With an elicited skew window of 30 seconds and a fake clock aligned to scheduledTime, dispatching a scheduled event fires cronFired with {expression, scheduledTime, outcome: onTime, duration: >=0} on the sink; no cronSkewed event fires for that dispatch.",
+      "given": "a dispatcher configured with skewToleranceMs=30000 and a fake clock aligned to scheduledTime",
+      "when": "an event is dispatched",
+      "then": "a cronFired event fires with outcome onTime and no cronSkewed fires",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-6201-2",
+      "description": "With an elicited skew window of 30 seconds and a fake clock advanced 60000ms past scheduledTime, dispatching a scheduled event fires cronSkewed with {expression, scheduledTime, outcome: skewed, duration: >=0, deltaMs: 60000} on the sink; the routed handler still runs.",
+      "given": "a dispatcher configured with skewToleranceMs=30000 and a fake clock advanced 60000ms past scheduledTime",
+      "when": "an event is dispatched",
+      "then": "a cronSkewed event fires with the observed delta and the handler still runs",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tags": [
+    "blueprint:platform-cloudflare-cron-triggers"
+  ],
+  "usId": "US-6201",
+  "prdId": "PRD-001",
+  "reqId": "REQ-062",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-2 skew tolerance: fires inside the elicited window are onTime; outside record cronSkewed with delta"
+}

package/rcf/user-stories/us-6301.json

@@ -0,0 +1,36 @@
+{
+  "createdAt": "2026-09-07T12:28:02.582Z",
+  "updatedAt": "2026-09-07T12:28:02.582Z",
+  "asA": "operator observing long-running scheduled work on a Worker",
+  "iWant": "the dispatcher to fire cronStalled at the moment a handler's observed duration crosses the elicited soft budget, without terminating the handler",
+  "soThat": "the applied logging companion surfaces stalled fires as a first-class signal, and the Worker's own CPU budget remains the vendor's concern",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-6301-1",
+      "description": "With softBudgetMs=100 and a spy handler that resolves after 250ms of fake-clock time, dispatching fires exactly one cronStalled event on the sink with {expression, scheduledTime, outcome: stalled, duration: >=100, softBudgetMs: 100} at the moment the observed duration crosses 100ms.",
+      "given": "a dispatcher configured with softBudgetMs=100 and a spy handler that resolves after 250ms fake-clock",
+      "when": "an event is dispatched",
+      "then": "a cronStalled event fires exactly once with the observed duration at or past the budget",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-6301-2",
+      "description": "With softBudgetMs=100 and a spy handler that resolves after 250ms of fake-clock time, the dispatcher does NOT terminate the handler on the soft-budget breach; the handler runs to completion, resolves, and a final cronFired event follows the cronStalled record with the total duration.",
+      "given": "a dispatcher configured with softBudgetMs=100 and a spy handler that resolves after 250ms fake-clock",
+      "when": "an event is dispatched",
+      "then": "the handler runs to completion and a cronFired follows the cronStalled record",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tags": [
+    "blueprint:platform-cloudflare-cron-triggers"
+  ],
+  "usId": "US-6301",
+  "prdId": "PRD-001",
+  "reqId": "REQ-063",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-2 soft budget: a handler running past the elicited budget logs cronStalled and continues"
+}

package/rcf/user-stories/us-6302.json

@@ -0,0 +1,27 @@
+{
+  "createdAt": "2026-09-07T12:28:02.788Z",
+  "updatedAt": "2026-09-07T12:28:02.788Z",
+  "asA": "security reviewer reading the applied logging companion's stream",
+  "iWant": "every cron lifecycle event record to carry only {event, expression, scheduledTime, outcome, duration} and optional numeric metadata fields; never a handler input, closure or PII substring",
+  "soThat": "the logging stream stays safe to ship to any downstream sink without a per-blueprint scrub pass",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-6302-1",
+      "description": "The event-secrecy probe drives the dispatcher with a spy handler that receives a PII fixture ({userId, ssn}) via a closure, and drives put/get/delete-style operations on a fixture key. The probe asserts (layer 1) every event record's keys are a subset of the allow-list {event, expression, scheduledTime, outcome, duration, softBudgetMs, deltaMs}; and (layer 2) the JSON serialisation of every record (excluding the expression field, which is a legitimate literal from wrangler.toml) contains no PII substring (userId numeric, ssn placeholder). SIMULATE_PII_LEAK=true injects a wrapper sink that forwards the closure onto the record; the probe surfaces the forbidden keys and the leaked substrings and returns aggregateVerdict: fail.",
+      "given": "the event-secrecy probe run under both modes",
+      "when": "the shipped code path runs without the switch; the mutation-path runs with SIMULATE_PII_LEAK=true",
+      "then": "shipped: aggregateVerdict pass with zero forbidden keys and zero PII hits. Switch on: aggregateVerdict fail with the leaked fields named.",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tags": [
+    "blueprint:platform-cloudflare-cron-triggers"
+  ],
+  "usId": "US-6302",
+  "prdId": "PRD-001",
+  "reqId": "REQ-063",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-2 event secrecy: every scheduled-side event record carries only metadata; no closure or PII"
+}

package/rcf/user-stories/us-7001.json

@@ -0,0 +1,27 @@
+{
+  "createdAt": "2026-09-07T14:11:53.037Z",
+  "updatedAt": "2026-09-07T14:13:26.508Z",
+  "usId": "US-7001",
+  "prdId": "PRD-001",
+  "reqId": "REQ-070",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-3 DO facade opens against env.CELL and env.HUB and emits namespaceReady",
+  "asA": "shelf consumer applying the platform-cloudflare-durable-objects v1.0.0 blueprint on a Workers project using the cf-platform fixture",
+  "iWant": "one DO facade module (src/do-facade.mjs) that opens against env.CELL and env.HUB on boot, wires the injected event sink and emits a namespaceReady lifecycle event with a metadata-only payload",
+  "soThat": "boot ordering is observable, the DO namespace seam is a single call site, and the applied project can compose its own bootstrapping around one predictable event",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-7001-1",
+      "description": "On process boot, createDoFacadeInProcess (the in-process seam over the shipped facade code path) wires the injected event sink and emits a namespaceReady event on the sink with a payload of exactly {event, key, size, ttl, timestamp} where key is null, size is 0 and ttl is null. facade.cell(name) and facade.hub(name) return the registered SingleCellObject and HubObject instances.",
+      "given": "a facade wired with in-process SingleCellObject and HubObject instances and a spy event sink",
+      "when": "the facade ready() call resolves",
+      "then": "a namespaceReady event fires exactly once on the sink with the metadata-only payload; the registered handles return the instances",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tags": [
+    "blueprint:platform-cloudflare-durable-objects"
+  ]
+}

package/rcf/user-stories/us-7002.json

@@ -0,0 +1,27 @@
+{
+  "createdAt": "2026-09-07T14:11:54.952Z",
+  "updatedAt": "2026-09-07T14:13:26.508Z",
+  "usId": "US-7002",
+  "prdId": "PRD-001",
+  "reqId": "REQ-070",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-3 real-account storage smoke records accountBoundSkipped without env var",
+  "asA": "operator validating platform-cloudflare-durable-objects v1.0.0 against a real Cloudflare account",
+  "iWant": "the real-account-storage-smoke probe to record accountBoundSkipped and aggregate to pass when CI_HAS_CLOUDFLARE_ACCOUNT is unset",
+  "soThat": "the shipped account-bound seam matches the Clerk pattern (skip-in-CI when no account, run when one is available) per spec section 3.5",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-7002-1",
+      "description": "The real-account-storage-smoke probe with CI_HAS_CLOUDFLARE_ACCOUNT unset returns a single result with anchorAcId AC-33112-1 and verdict pass; the report carries accountBoundSkipped=true and aggregates to pass; exit code 0. With CI_HAS_CLOUDFLARE_ACCOUNT=true but any of CF_ACCOUNT_ID, CF_DO_NAMESPACE_ID or CF_API_TOKEN missing, the probe returns fail naming the missing keys.",
+      "given": "the real-account-storage-smoke probe module",
+      "when": "run without CI_HAS_CLOUDFLARE_ACCOUNT, and then with the env var but no paired creds",
+      "then": "the first run reports accountBoundSkipped and passes; the second reports the missing keys and fails",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tags": [
+    "blueprint:platform-cloudflare-durable-objects"
+  ]
+}

package/rcf/user-stories/us-7101.json

@@ -0,0 +1,27 @@
+{
+  "createdAt": "2026-09-07T14:11:53.254Z",
+  "updatedAt": "2026-09-07T14:13:26.508Z",
+  "usId": "US-7101",
+  "prdId": "PRD-001",
+  "reqId": "REQ-071",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-3 single-cell concurrent increments serialise per instance and return witness of prior write",
+  "asA": "developer whose Worker needs an authoritative counter, session store or lock behind a swappable boundary",
+  "iWant": "one SingleCellObject instance to observe concurrent increments in per-instance FIFO order and return the sum plus a written witness",
+  "soThat": "two concurrent callers cannot silently overwrite each other and a domain assertion can prove the write happened before the read",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-7101-1",
+      "description": "Two concurrent increment(1) invocations against a SingleCellObject with counter 0 resolve to counters [1, 2] and witnesses [0, 1] in FIFO order; a subsequent read() returns counter 2.",
+      "given": "a SingleCellObject at counter 0",
+      "when": "two concurrent increment(1) calls fire and read() follows",
+      "then": "counters are [1,2], witnesses are [0,1], read returns 2",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tags": [
+    "blueprint:platform-cloudflare-durable-objects"
+  ]
+}

package/rcf/user-stories/us-7201.json

@@ -0,0 +1,27 @@
+{
+  "createdAt": "2026-09-07T14:11:53.463Z",
+  "updatedAt": "2026-09-07T14:13:26.508Z",
+  "usId": "US-7201",
+  "prdId": "PRD-001",
+  "reqId": "REQ-072",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-3 storage round-trip covers put/get/delete/list on both SQL and KV backends",
+  "asA": "developer configuring the storage backend on a new SingleCellObject",
+  "iWant": "the shipped storage driver factory to round-trip put/get/delete/list on both SQL and KV backends",
+  "soThat": "the applied project can elicit the backend at apply time and the shipped code path exercises both branches without code changes",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-7201-1",
+      "description": "createInMemoryDoStorage({backend: \"sql\"}) and createInMemoryDoStorage({backend: \"kv\"}) both round-trip put(\"k\",\"v\")->get(\"k\"), delete(\"k\") followed by get returning undefined, and list({prefix:\"p/\"}) returning a Map keyed by the prefix. driver.backend reports the chosen backend on each factory.",
+      "given": "two storage drivers, one on each backend",
+      "when": "put/get/delete/list operations are driven on each driver in turn",
+      "then": "both round-trip identically and driver.backend reports the elicited answer",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tags": [
+    "blueprint:platform-cloudflare-durable-objects"
+  ]
+}

package/rcf/user-stories/us-7301.json

@@ -0,0 +1,27 @@
+{
+  "createdAt": "2026-09-07T14:11:53.683Z",
+  "updatedAt": "2026-09-07T14:13:26.508Z",
+  "usId": "US-7301",
+  "prdId": "PRD-001",
+  "reqId": "REQ-073",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-3 alarm fires exactly once and doAlarmFired records objectName and scheduledTime",
+  "asA": "developer whose SingleCellObject schedules future work via storage.setAlarm",
+  "iWant": "the alarm() handler to fire exactly once per scheduled time and doAlarmFired to carry objectName and scheduledTime",
+  "soThat": "the applied project can observe alarm delivery through the metadata-only sink and trust the once-per-schedule contract",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-7301-1",
+      "description": "A SingleCellObject with setAlarm(100) fires alarm() once. The handler drains the persisted alarm (storage.getAlarm returns null after) and emits doAlarmFired with objectName and scheduledTime. A second alarm() call on the drained storage records scheduledTime null (no re-fire for the same schedule).",
+      "given": "a SingleCellObject with setAlarm(100)",
+      "when": "alarm() is driven once and then again after the fire",
+      "then": "the first fire emits doAlarmFired with the scheduledTime; the second fire records scheduledTime null; storage.getAlarm returns null after the first fire",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tags": [
+    "blueprint:platform-cloudflare-durable-objects"
+  ]
+}

package/rcf/user-stories/us-7401.json

@@ -0,0 +1,27 @@
+{
+  "createdAt": "2026-09-07T14:11:53.895Z",
+  "updatedAt": "2026-09-07T14:13:26.508Z",
+  "usId": "US-7401",
+  "prdId": "PRD-001",
+  "reqId": "REQ-074",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-3 hub broadcast fans out a payload from A to all connected clients within the elicited window",
+  "asA": "developer coordinating multiplayer websocket clients through one authoritative hub",
+  "iWant": "the HubObject to fan out a broadcast payload from one connected client to all connected clients within the elicited window",
+  "soThat": "the shipped hub shape delivers the coordinated-multiplayer contract without a hand-rolled broadcast layer",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-7401-1",
+      "description": "A HubObject with two accepted fake websockets A and B, when driven with webSocketMessage(A, JSON.stringify({type:\"broadcast\", payload:\"ping\"})), delivers a JSON message to both A and B whose type is \"broadcast\" and payload is \"ping\" within 500ms elapsed on the fixture clock. The persisted lastBroadcast key in storage carries the serialised outbound payload.",
+      "given": "a HubObject with two accepted fake websockets",
+      "when": "a broadcast message is sent from A",
+      "then": "both A and B receive the broadcast within 500ms; storage.get(\"lastBroadcast\") returns the serialised payload",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tags": [
+    "blueprint:platform-cloudflare-durable-objects"
+  ]
+}

package/rcf/user-stories/us-7402.json

@@ -0,0 +1,27 @@
+{
+  "createdAt": "2026-09-07T14:11:54.109Z",
+  "updatedAt": "2026-09-07T14:13:26.508Z",
+  "usId": "US-7402",
+  "prdId": "PRD-001",
+  "reqId": "REQ-074",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-3 hibernate-and-wake round-trip preserves storage and doWakeUp fires exactly once",
+  "asA": "developer whose HubObject hibernates when idle and wakes on the next message",
+  "iWant": "the wake handler to run from cold and read the same lastBroadcast key from storage the pre-hibernate state persisted",
+  "soThat": "a re-emerging client can catch up on the missed broadcast without a full re-sync",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-7402-1",
+      "description": "A HubObject that has processed a broadcast, hibernated (doHibernate emitted), and then woken (doWakeUp emitted once) resolves wake() with lastBroadcast equal to the serialised outbound payload. A second wake() resolves with alreadyAwake=true and the same lastBroadcast; no second doWakeUp fires.",
+      "given": "a HubObject with a persisted lastBroadcast that has hibernated",
+      "when": "wake() is called once, then again",
+      "then": "the first wake emits doWakeUp once and returns lastBroadcast; the second wake reports alreadyAwake without a second event",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tags": [
+    "blueprint:platform-cloudflare-durable-objects"
+  ]
+}

package/rcf/user-stories/us-7501.json

@@ -0,0 +1,27 @@
+{
+  "createdAt": "2026-09-07T14:11:54.320Z",
+  "updatedAt": "2026-09-07T14:13:26.508Z",
+  "usId": "US-7501",
+  "prdId": "PRD-001",
+  "reqId": "REQ-075",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-3 lifecycle events on the shipped path carry only allowed metadata keys",
+  "asA": "reviewer verifying the platform-cloudflare-durable-objects v1.0.0 blueprint at mechanism reach",
+  "iWant": "every lifecycle event emitted on the shipped code path to carry only the allowed metadata keys and never a forbidden key",
+  "soThat": "a logging companion can render the sink directly without a per-blueprint scrub pass",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-7501-1",
+      "description": "The event-secrecy result on the websocket-hub-broadcast probe scans every record emitted through the facade and both DO classes on the shipped path and asserts every top-level key is drawn from {event, key, size, ttl, timestamp, objectName, scheduledTime}. Under SIMULATE_PII_LEAK=true a wrapped sink forwards a synthetic body-bearing record; the probe surfaces the forbidden keys (body, ssn, userId) and returns fail on the AC-33106-1 result.",
+      "given": "a driven facade + single-cell + hub with an accumulating spy sink, and the SIMULATE_PII_LEAK switch",
+      "when": "the event-secrecy AC-33106-1 result runs on the shipped path and the simulate path",
+      "then": "the shipped path returns pass with zero forbidden keys; the simulate path surfaces the injected fields and returns fail",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tags": [
+    "blueprint:platform-cloudflare-durable-objects"
+  ]
+}

package/rcf/user-stories/us-7601.json

@@ -0,0 +1,27 @@
+{
+  "createdAt": "2026-09-07T14:11:54.530Z",
+  "updatedAt": "2026-09-07T14:13:26.508Z",
+  "usId": "US-7601",
+  "prdId": "PRD-001",
+  "reqId": "REQ-076",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-3 sole-reader-scan probe surfaces every non-facade module that dereferences env.CELL or env.HUB",
+  "asA": "reviewer enforcing the sole-reader guarantee on env.CELL and env.HUB",
+  "iWant": "the sole-reader-scan probe to walk every .mjs/.js/.ts file under the fixture applied source root and assert only src/do-facade.mjs dereferences env.CELL or env.HUB in live source",
+  "soThat": "a legacy call site or an accidental new one surfaces at self-review, not at runtime",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-7601-1",
+      "description": "The sole-reader-scan probe reads every .mjs/.js/.ts file under packages/rcf-lite/test/fixtures/cf-platform/src, strips block and line comments, matches literal env.CELL and env.HUB and reports every non-facade file with a live match as a leak. The clean-fixture scan surfaces zero leaks. Under SIMULATE_NON_FACADE_IMPORT=true a scratch leaker at $TMPDIR/t3-sole-reader-scratch is included in the scan; the scan surfaces the leak and returns fail.",
+      "given": "the cf-platform fixture applied source root, and optionally the SIMULATE_NON_FACADE_IMPORT switch",
+      "when": "the sole-reader-scan probe runs",
+      "then": "clean scan returns pass with zero leaks; simulate scan surfaces the injected leaker and returns fail",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tags": [
+    "blueprint:platform-cloudflare-durable-objects"
+  ]
+}

package/rcf/user-stories/us-7701.json

@@ -0,0 +1,27 @@
+{
+  "createdAt": "2026-09-07T14:11:54.740Z",
+  "updatedAt": "2026-09-07T14:13:26.508Z",
+  "usId": "US-7701",
+  "prdId": "PRD-001",
+  "reqId": "REQ-077",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-3 wrangler.toml commits stable DO class names on both binding blocks and a migrations tag records the mint classes",
+  "asA": "operator applying platform-cloudflare-durable-objects on a fresh Workers project",
+  "iWant": "the generated wrangler.toml to carry [[durable_objects.bindings]] blocks and a paired [[migrations]] block with a stable tag",
+  "soThat": "a future rename lands as a wrangler migration rather than a silent rewire and the DO class identity survives the mint",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-7701-1",
+      "description": "The fixture wrangler.toml carries at least two [[durable_objects.bindings]] blocks (one binding named CELL with class_name SingleCellObject; one binding named HUB with class_name HubObject) and at least one [[migrations]] block with tag \"v1\" and new_classes = [\"SingleCellObject\", \"HubObject\"]. The anatomy assertion greps the toml for each literal string and the migrations pair.",
+      "given": "the cf-platform fixture wrangler.toml",
+      "when": "the anatomy assertion greps for the four literal strings and the migrations pair",
+      "then": "every string is present and the migrations tag \"v1\" carries the two class names",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tags": [
+    "blueprint:platform-cloudflare-durable-objects"
+  ]
+}

package/rcf/user-stories/us-8001.json

@@ -0,0 +1,24 @@
+{
+  "createdAt": "2026-09-07T16:49:29.505Z",
+  "updatedAt": "2026-09-07T16:51:26.217Z",
+  "usId": "US-8001",
+  "prdId": "PRD-001",
+  "reqId": "REQ-080",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-4 JWT validator: fixture-signed JWT validates and principal reduces onto request.auth",
+  "asA": "shelf consumer applying the edge-cloudflare-access v1.0.0 blueprint on a Workers project using the cf-edge fixture",
+  "iWant": "the Cf-Access-Jwt-Assertion header validated against the Access JWKS on every request, the principal reduced into request.auth as {email, sub, groups} and the downstream handler observes 200 with the reduced principal fields",
+  "soThat": "the Worker only ever sees authenticated principals and downstream code reads a single stable seam for identity",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-8001-1",
+      "description": "The JWT validator reads Cf-Access-Jwt-Assertion, verifies against the fixture JWKS (RS256, kid rotation supported by cache), reduces the principal into request.auth as {email, sub, groups} and the downstream handler receives a 200 with the reduced principal fields exposed on request.auth.",
+      "given": "a Worker fetch handler wired with the createAccessValidator middleware and a fixture-signed JWT presented in the Cf-Access-Jwt-Assertion header",
+      "when": "the request dispatches through the validator",
+      "then": "the validator resolves, attaches {email, sub, groups} onto request.auth and delegates to the handler which returns 200 with request.auth reflected on the response body",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ]
+}

package/rcf/user-stories/us-8002.json

@@ -0,0 +1,24 @@
+{
+  "createdAt": "2026-09-07T16:49:29.726Z",
+  "updatedAt": "2026-09-07T16:51:26.402Z",
+  "usId": "US-8002",
+  "prdId": "PRD-001",
+  "reqId": "REQ-080",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-4 JWT validator: missing, expired or mis-signed JWT rejects 401 with metadata-only audit event",
+  "asA": "shelf consumer applying the edge-cloudflare-access v1.0.0 blueprint on a Workers project using the cf-edge fixture",
+  "iWant": "requests carrying a missing, expired or mis-signed JWT to reject with 401 and emit exactly one metadata-only audit event on the shipped audit sink",
+  "soThat": "unauthenticated traffic cannot reach the downstream handler and every reject is observable without leaking the token value or headers",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-8002-1",
+      "description": "The three reject subcases (missing header, expired exp, mis-signed) each return HTTP 401 and emit exactly one audit event whose keys are drawn from {email, outcome, timestamp, path} with no token substring, no header names beyond path, and no additional keys.",
+      "given": "a Worker fetch handler wired with the createAccessValidator middleware and one of the three reject subcases",
+      "when": "the request dispatches through the validator",
+      "then": "the validator resolves 401, emits one audit event with outcome in {missing, expired, invalid} and the record body carries only the four allowed keys",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ]
+}

package/rcf/user-stories/us-8003.json

@@ -0,0 +1,24 @@
+{
+  "createdAt": "2026-09-07T16:49:29.941Z",
+  "updatedAt": "2026-09-07T16:51:26.586Z",
+  "usId": "US-8003",
+  "prdId": "PRD-001",
+  "reqId": "REQ-080",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-4 JWT validator is the sole reader of the Cf-Access-Jwt-Assertion header in the applied source tree",
+  "asA": "shelf consumer applying the edge-cloudflare-access v1.0.0 blueprint on a Workers project using the cf-edge fixture",
+  "iWant": "only src/jwt-validator.mjs to dereference the Cf-Access-Jwt-Assertion header string in the applied source tree",
+  "soThat": "the validator is the single seam and a stray header read in the applied code is a defect the AST scan catches",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-8003-1",
+      "description": "The sole-reader scan walks the fixture applied source root (src/**/*.mjs), strips comments and string literals, and finds exactly one live source occurrence of the header string Cf-Access-Jwt-Assertion, in src/jwt-validator.mjs. Any other occurrence in a shipped module fails the probe.",
+      "given": "the cf-edge fixture applied source tree",
+      "when": "the sole-reader-scan probe walks src/**/*.mjs",
+      "then": "the only live-source hit for Cf-Access-Jwt-Assertion is in src/jwt-validator.mjs; SIMULATE_NON_VALIDATOR_HEADER=true injects a second hit and the probe fails",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ]
+}