rcf-lite 0.23.0 → 0.25.0

package/blueprints/deploy-hetzner-server/contributions/user-stories/deploy-hetzner-server-us-37104.json

@@ -0,0 +1,24 @@
+{
+  "usId": "deploy-hetzner-server-US-37104",
+  "prdId": "PRD-001",
+  "reqId": "deploy-hetzner-server-REQ-003",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Cloud-init template renders the six hardening baseline blocks",
+  "asA": "developer whose project provisions Hetzner servers that face the public internet",
+  "iWant": "the shipped cloud-init template to render YAML that lands SSH key-only, root disabled, UFW default-deny incoming, DOCKER-USER iptables chain, fail2ban SSH jail and unattended-upgrades on every server",
+  "soThat": "I inherit the six-block hardening baseline declaratively without hand-authoring per host",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-37104-1",
+      "description": "cloud-init-render-lint.mjs renders the template with the fixture manifest and asserts each of the six baseline blocks (SSH key-only, root disabled, UFW default-deny incoming, DOCKER-USER iptables chain, fail2ban SSH jail, unattended-upgrades) appears in the rendered YAML by grep; a mutation SIMULATE_HARDENING_DRIFT=true removes the unattended-upgrades block and the probe FAILS with a message naming the missing line.",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-3803-deploy-hetzner-server-cloud-init-template"
+  ],
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/deploy-hetzner-server/contributions/user-stories/deploy-hetzner-server-us-37105.json

@@ -0,0 +1,24 @@
+{
+  "usId": "deploy-hetzner-server-US-37105",
+  "prdId": "PRD-001",
+  "reqId": "deploy-hetzner-server-REQ-003",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Provisioned server is hardened at runtime as the rendered cloud-init promised",
+  "asA": "operator running Hetzner servers provisioned by this blueprint",
+  "iWant": "the running server to refuse root ssh, refuse password auth, run UFW default-deny incoming, hold the DOCKER-USER chain and run unattended-upgrades",
+  "soThat": "I can trust the cloud-init contract without ssh-in-and-check on every server",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-37105-1",
+      "description": "real-account-cloud-init-hardened.mjs (accountBound: true, skipped without CI_HAS_HETZNER_ACCOUNT) waits for cloud-init status --wait on the throwaway server, then ssh-checks the six baseline blocks and asserts each check passes; failure names the missing block. Teardown via destroy.mjs runs regardless.",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-3803-deploy-hetzner-server-cloud-init-template"
+  ],
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/deploy-hetzner-server/contributions/user-stories/deploy-hetzner-server-us-37106.json

@@ -0,0 +1,25 @@
+{
+  "usId": "deploy-hetzner-server-US-37106",
+  "prdId": "PRD-001",
+  "reqId": "deploy-hetzner-server-REQ-004",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Firewall rule shape restricts SSH to nominated prefixes, permits 80/443, denies all else",
+  "asA": "operator running Hetzner servers that face the public internet",
+  "iWant": "the firewall rule set carried in hetzner/servers/name.json to permit 22 only from an operator-nominated set of source-prefix ranges, permit 80 and 443 from any source for the reverse proxy, and deny all other inbound; the provisioner applies the rules at provision time",
+  "soThat": "I inherit a documented least-privilege firewall shape on every server without opening ssh to the world",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-37106-1",
+      "description": "manifest-schema-validate.mjs asserts every fixture manifest carries a firewallRules array matching the shape (22 permitted only from a nonempty list of source-prefix ranges with no 0.0.0.0/0; 80 and 443 permitted from 0.0.0.0/0; no other inbound rule); an induced defect (a manifest that opens 22 to 0.0.0.0/0) FAILS schema validation with a message naming the offending rule.",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-3802-deploy-hetzner-server-manifest-schema",
+    "TAC-3804-deploy-hetzner-server-firewall-shape"
+  ],
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/deploy-hetzner-server/contributions/user-stories/deploy-hetzner-server-us-37107.json

@@ -0,0 +1,24 @@
+{
+  "usId": "deploy-hetzner-server-US-37107",
+  "prdId": "PRD-001",
+  "reqId": "deploy-hetzner-server-REQ-005",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Snapshot cadence is elicited (weekly default, daily and off alternatives) and validated on the manifest",
+  "asA": "operator whose project takes recovery-point snapshots on Hetzner Cloud",
+  "iWant": "the elicited snapshot cadence value on hetzner/servers/name.json to match the shipped enum {weekly, daily, off}, with weekly the recommended default per ADR-3802",
+  "soThat": "I have one project-wide answer for how often each server snapshots",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-37107-1",
+      "description": "manifest-schema-validate.mjs asserts every fixture manifest carries snapshotCadence with a value in the shipped enum {weekly, daily, off}; a manifest missing the field FAILS schema validation naming the missing field.",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-3802-deploy-hetzner-server-manifest-schema"
+  ],
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/deploy-hetzner-server/contributions/user-stories/deploy-hetzner-server-us-37108.json

@@ -0,0 +1,24 @@
+{
+  "usId": "deploy-hetzner-server-US-37108",
+  "prdId": "PRD-001",
+  "reqId": "deploy-hetzner-server-REQ-005",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Snapshot-on-demand fires a tagged snapshot and emits hetznerSnapshotTaken",
+  "asA": "operator whose project needs an on-demand recovery point at any moment",
+  "iWant": "the snapshot-on-demand verb on the provisioner to shell to hcloud image create-image (or the raw-api equivalent) and tag the snapshot with server name and wall-clock time; hetznerSnapshotTaken carries snapshot id and time",
+  "soThat": "I have a documented on-demand recovery point at any moment without a manual dashboard visit",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-37108-1",
+      "description": "real-account-snapshot-on-demand.mjs (accountBound: true, skipped without CI_HAS_HETZNER_ACCOUNT) fires the snapshot verb on the throwaway server, then asserts hcloud image list --type=snapshot --output json shows a snapshot tagged with the server name and current wall-clock time; hetznerSnapshotTaken event carries snapshot id and time. Teardown via destroy.mjs.",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-3801-deploy-hetzner-server-provisioner"
+  ],
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/deploy-hetzner-server/contributions/user-stories/deploy-hetzner-server-us-37109.json

@@ -0,0 +1,24 @@
+{
+  "usId": "deploy-hetzner-server-US-37109",
+  "prdId": "PRD-001",
+  "reqId": "deploy-hetzner-server-REQ-006",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Four lifecycle events fire with metadata-only payloads and no event body carries a secret",
+  "asA": "operator whose observability sink carries the Hetzner lifecycle trail",
+  "iWant": "the provisioner facade to fire the four lifecycle events (provisionerReady, hetznerServerProvisioned, hetznerSnapshotTaken, hetznerServerDestroyed) with metadata-only payloads and no secret content",
+  "soThat": "the observability sink carries the operational trail without ever leaking a token or an ssh key",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-37109-1",
+      "description": "hcloud-dry-run-mock.mjs drives every lifecycle event through the facade against a mocked hcloud shim; the accumulated event stream carries only the metadata fields named on REQ-006; a mutation SIMULATE_EVENT_SECRECY_LEAK=true injects the token into the hetznerServerProvisioned payload and the probe FAILS with a defensive-fake finding naming the leaked field.",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-3801-deploy-hetzner-server-provisioner"
+  ],
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/deploy-hetzner-server/docs/topics.md

@@ -0,0 +1,48 @@
+# deploy-hetzner-server topics
+
+Shelf registry of global ADR topics and shelf-band anchors relevant
+to `deploy-hetzner-server` v1.0.0.
+
+## Global topics minted by this blueprint
+
+| Topic | ADR | Meaning |
+|---|---|---|
+| `linuxCloudHostContract` | `ADR-3801` | The Hetzner Cloud VM as the shipped `cloudHost` shape. A future non-Hetzner sibling (Vultr, DigitalOcean, Fly.io) contributes the same topic string with a different provider and forces a deliberate conflict per the round-2 pattern. |
+| `snapshotAndBackupCadence` | `ADR-3802` | Weekly snapshot as the shipped default, daily and off alternatives, Hetzner-managed backups as an elicited paid opt-in at approximately 20 percent of monthly server price. |
+
+## Shelf id band and suffix block
+
+| Blueprint | US band | ADR/TAC suffix block | Status | Global topics |
+|---|---|---|---|---|
+| application-datatable | 17101-17899 | 18xx | shipped v1.0.0 | none |
+| application-charts | 18101-18899 | 19xx | shipped v1.0.0 | none |
+| application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
+| application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
+| application-admin-console | 21101-21899 | 22xx | shipped v1.1.0 | `adminConsoleSignInSurface` |
+| application-empty-error-states | 22101-22899 | 23xx | shipped v1.0.0 | none |
+| application-file-upload | 23101-23899 | 24xx | shipped v1.0.0 | none |
+| application-forms-wizard | 24101-24899 | 25xx | shipped v1.0.0 | none |
+| application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
+| application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
+| persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
+| jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
+| platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |
+| platform-cloudflare-cron-triggers | 32101-32899 | 33xx | shipped v1.0.0 | `scheduledTriggerContract` |
+| platform-cloudflare-durable-objects | 33101-33899 | 34xx | shipped v1.0.0 | `strongConsistencyCellContract`, `websocketHubContract` |
+| edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
+| edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
+| edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
+| deploy-hetzner-server | 37101-37899 | 38xx | shipped v1.0.0 | `linuxCloudHostContract`, `snapshotAndBackupCadence` |
+| platform-docker-compose-host | 38101-38899 | 39xx | shipped v1.0.0 | `containerHostContract` |
+| edge-cloudflare-tunnel | 39101-39899 | 40xx | shipped v1.0.0 | `edgeIngressBridge` |
+
+The shelf-wide band registry lives in `packages/rcf-lite/docs/blueprint-authoring.md` section 5.
+
+## Cross-references
+
+- `security-secrets-management` (v1.0.1): the provisioner facade reads `HETZNER_ACCOUNT_API_KEY` through the applied secrets facade. The facade is the sole reader; every other module in the applying project imports the facade and never dereferences the token.
+- `deploy-cloudflare-workers` (v1.2.0): sibling in the `deploy-*` family. The family enforces one-target-per-project at apply time (a project applying both refuses with `deploy-family-multiple-targets`).
+- Round-7 T-2 `platform-docker-compose-host`: composes on `capabilities: [cloudHost]`; ships the compose runtime on the Hetzner host this blueprint provisions.
+- Round-7 T-3 `edge-cloudflare-tunnel`: composes on `cloudHost` (systemd unit shape) or on `containerHost` (compose service shape); either shape bridges the Hetzner host to the Cloudflare edge without opening origin ports.

package/blueprints/deploy-hetzner-server/guide/deploy-hetzner-server.md

@@ -0,0 +1,180 @@
+# deploy-hetzner-server guide
+
+Practical guide for the operator applying `deploy-hetzner-server`
+v1.0.0. Covers manifest authoring, the two provisioner paths, the
+hardening baseline, snapshot posture, elicitation shortcuts, and
+the runtime probe rig.
+
+## Prerequisites
+
+- A Hetzner Cloud project and API token. The token binds to one
+  project; a fresh throwaway project keeps the blast radius small
+  during onboarding.
+- `hcloud` on `PATH` when `provisioning-tool` is `hcloud`. Install:
+  Homebrew `brew install hcloud` on macOS, or download the OS/arch
+  tarball from https://github.com/hetznercloud/cli/releases/latest,
+  verify against `checksums.txt`, drop the binary on `PATH`. Skip
+  the install when `provisioning-tool` is `raw-api`; the provisioner
+  reaches the REST API directly.
+- `security-secrets-management` applied so the facade reads
+  `HETZNER_ACCOUNT_API_KEY` from the operator's vault of choice.
+
+## Authoring `hetzner/servers/<name>.json`
+
+Every server declaration lives at
+`hetzner/servers/<server-name>.json` and validates against the
+shipped `hetzner-server.schema.json`. The fixture manifest at
+`packages/rcf-lite/test/fixtures/hetzner-throwaway-server/hetzner/servers/ci-throwaway.json`
+is the canonical example. Copy it and edit:
+
+```jsonc
+{
+  "name": "ops-01",
+  "serverType": "cx33",
+  "location": "fsn1",
+  "image": "ubuntu-24.04",
+  "sshKeyIds": ["dave-ed25519", "baz-yubikey"],
+  "networkId": null,
+  "firewallId": null,
+  "cloudInitPath": "hetzner/servers/rendered/ops-01.cloud-init.yaml",
+  "labels": {
+    "role": "ops-host",
+    "blueprint": "deploy-hetzner-server"
+  },
+  "firewallRules": [
+    { "name": "ssh", "protocol": "tcp", "port": 22, "direction": "in", "sourceIps": ["203.0.113.0/24"] },
+    { "name": "http", "protocol": "tcp", "port": 80, "direction": "in", "sourceIps": ["0.0.0.0/0", "::/0"] },
+    { "name": "https", "protocol": "tcp", "port": 443, "direction": "in", "sourceIps": ["0.0.0.0/0", "::/0"] }
+  ],
+  "snapshotCadence": "weekly",
+  "hetznerManagedBackups": false
+}
+```
+
+The manifest-schema-validate probe refuses on missing required
+fields and on a rule set that opens 22 to `0.0.0.0/0`.
+
+## Rendering cloud-init
+
+Point `cloudInitPath` at a rendered file the provisioner uploads
+with `--user-data-from-file`. The fixture renderer at
+`packages/rcf-lite/test/fixtures/hetzner-throwaway-server/src/cloud-init-renderer.mjs`
+consumes the shipped template with two placeholders:
+
+- `{{name}}` (the manifest name)
+- `{{sshAuthorizedKeysBlock}}` (the ssh-authorized_keys entries per
+  `sshKeyIds`)
+
+An applying project runs the renderer at manifest edit time (a git
+pre-commit hook, or a `pnpm build:cloud-init` script) and commits
+the rendered YAML alongside the manifest.
+
+## Six hardening baseline blocks (ADR-3804)
+
+The rendered YAML lands the six blocks per the estate baseline at
+`operator/knowledge/systems/environments/hetzner-cloud/overview.md`
+Security posture baseline and the Debian unattended-upgrades wiki
+at https://wiki.debian.org/UnattendedUpgrades.
+
+1. SSH key-only. `PasswordAuthentication no`.
+2. Root disabled. `PermitRootLogin no`.
+3. UFW default-deny incoming. `ufw allow 22/tcp 80/tcp 443/tcp`.
+4. DOCKER-USER iptables chain. Drops non-conforming egress from
+   containers before Docker rules apply.
+5. fail2ban SSH jail on port 22. `maxretry 5`, `bantime 3600`.
+6. `unattended-upgrades` on for security-only updates
+   (`Unattended-Upgrade::Automatic-Reboot "false"`).
+
+Deviation costs an ADR at the applying project level; the shipped
+lint refuses on drift.
+
+## When to reach for hcloud vs raw-api
+
+- `hcloud` (default). Choose it when the operator laptop and CI
+  runner can install the binary. Small, self-documenting, JSON
+  output on `--output json`; the vendor updates it in step with the
+  API. Docs: https://github.com/hetznercloud/cli.
+- `raw-api`. Choose it when a container base image cannot install
+  `hcloud` (Alpine minimal builds, a locked-down runtime). The
+  provisioner reaches the REST endpoints directly per
+  https://docs.hetzner.cloud/. Vendor SLAs cover the API; the local
+  CLI is a convenience layer.
+
+The facade shape is identical on both paths so switching is a one
+elicit change.
+
+## When to reach for `cx23` vs `cx33`
+
+- `cx23` (default). Two vCPU, 4 GB RAM, 40 GB SSD. Approximately
+  EUR 4.15/month. Fine for the docker-compose stack that ops-01
+  runs (fewer than ten containers, each below 300 MB RSS).
+- `cx33`. Two vCPU, 8 GB RAM, 80 GB SSD. Approximately EUR
+  7.99/month. Reach when the compose stack holds a Postgres, a
+  Grafana, or any container that regularly touches 1 GB RSS.
+- `cx43`. Four vCPU, 16 GB RAM. Reach for a home for the
+  `platform-cloudflare-durable-objects` self-hosted mode or a
+  Postgres + Grafana + Loki triad.
+- `cpx*`. AMD EPYC. Faster per vCPU; slightly more expensive.
+- `cax*`. ARM64. Choose when every runtime component has an ARM
+  build (Node, Postgres, cloudflared, most caddy modules do).
+
+Vendor pricing:
+https://docs.hetzner.com/cloud/servers/overview.
+
+## Snapshot cadence choices (ADR-3802)
+
+- `weekly` (default). One snapshot every Sunday at 02:00 local. On
+  a `cx23`, adds approximately EUR 0.005/month in snapshot storage.
+- `daily`. Higher recovery-point objective. On a `cx23`, adds
+  approximately EUR 0.035/month.
+- `off`. No automatic snapshot. Choose only when Hetzner-managed
+  backups are opted-in AND the application layer takes its own
+  logical backups on cadence.
+
+Hetzner-managed backups are a separately elicited paid opt-in at
+approximately 20 percent of monthly server price (on a `cx23`,
+approximately EUR 0.80/month). They compose with the scheduled
+snapshot runner; both fire independently.
+Vendor pricing:
+https://docs.hetzner.com/cloud/servers/backups-snapshots/overview.
+
+## Snapshot-on-demand
+
+Fire a snapshot manually from the applying project's CLI:
+
+```
+node ./scripts/snapshot.mjs --server ops-01
+```
+
+The script imports the provisioner facade, calls `takeSnapshot`,
+and emits `hetznerSnapshotTaken` on the injected sink. The account-
+bound probe `real-account-snapshot-on-demand` covers the same shape.
+
+## The shared throwaway-server fixture
+
+Every real-account probe runs against a throwaway `cx23` in `fsn1`
+provisioned from the fixture manifest. Fixture location:
+`packages/rcf-lite/test/fixtures/hetzner-throwaway-server/`. Cost
+ceiling: EUR 0.006/hour per run; destroy runs in `always()`; nightly
+`sweep-orphans` cron collects any leak on a 60-minute label-age
+cutoff.
+
+Round-7 T-2 (`platform-docker-compose-host`) and T-3
+(`edge-cloudflare-tunnel`) EXTEND this fixture rather than shipping
+a second copy. T-2 mounts the docker + compose verbs on the same
+throwaway server after cloud-init seals the baseline; T-3 mounts
+`cloudflared` on the runtime T-2 stands up.
+
+## Standards trace
+
+Every URL fetched 200 in the ratifying pass before the T-1 PR.
+
+- Hetzner Cloud API https://docs.hetzner.cloud/
+- Hetzner Cloud CLI https://github.com/hetznercloud/cli
+- Hetzner Cloud servers overview https://docs.hetzner.com/cloud/servers/overview
+- Hetzner Cloud firewalls overview https://docs.hetzner.com/cloud/firewalls/overview/
+- Hetzner Cloud backups-and-snapshots overview https://docs.hetzner.com/cloud/servers/backups-snapshots/overview
+- Hetzner Cloud networks overview https://docs.hetzner.com/cloud/networks/overview/
+- Hetzner community basic-cloud-config tutorial https://community.hetzner.com/tutorials/basic-cloud-config
+- cloud-init https://cloudinit.readthedocs.io/en/latest/
+- Debian unattended-upgrades wiki https://wiki.debian.org/UnattendedUpgrades

package/blueprints/edge-cloudflare-access/CHANGELOG.md

@@ -0,0 +1,23 @@
+# Changelog
+
+All notable changes to `edge-cloudflare-access` are recorded here. The shape follows Keep a Changelog and Semantic Versioning per the blueprint authoring standard.
+
+## 1.0.0 (2026-09-07)
+
+### Added
+
+- v1.0.0 mint of the `edge-cloudflare-access` blueprint, category `edge`, capabilities `["zeroTrustGate"]`. Ships a shipped JWT validator middleware that is the sole reader of the `Cf-Access-Jwt-Assertion` header per REQ-001, an Access application declaration surface with elicited hostname or self-hosted-app id, an elicited policy shape from the enum (email-domain, service-token-only, service-token-plus-email-domain, group-membership), a metadata-only audit event contract per REQ-004, and a break-glass posture per REQ-005 with an elicited service-auth pair for CI-signed automation.
+- 6 REQs (`edge-cloudflare-access-REQ-001..006`), 9 USs (`edge-cloudflare-access-US-34101..34109`), 4 TACs (`TAC-3501` JWT validator, `TAC-3502` Access application declaration, `TAC-3503` policy shape enum, `TAC-3504` audit sink), 4 ADRs (`ADR-3501` scope-global on new topic `edgeAuthenticationGate` with `standardsTraceClause: Cloudflare Access policy actions and rule selectors`; `ADR-3502` identity provider elicited with `recommendedDefault: null`; `ADR-3503` policy scope elicited with `recommendedDefault: application-level`; `ADR-3504` audit retention delegated to the applied logging companion with sentinel clause).
+- 6 Node-only probes under `contributions/probes/`: `jwt-validator-fixture` (fixture-signed JWT validates and principal reduces to `{email, sub, groups}` on request.auth), `jwt-validator-reject` (three subcases: missing header, expired exp, mis-signed each return 401 with one metadata-only audit event), `admin-console-gate-surface` (extended admin-console fixture flips its sign-in surface per applied capability set; covers `AC-34108-1`), `audit-event-secrecy` (5 pass + 5 reject runs produce 10 metadata-only records with no forbidden substrings, no token slices, no header names beyond `path`), `real-account-gated-url` (`accountBound: true`; records `accountBoundSkipped: true` in CI without `CI_HAS_CLOUDFLARE_ACCOUNT` per spec section 3.5) and `wrangler-seam` (drives `wrangler dev --local` on the fixture; `/protected` returns HTTP 401 on the shipped validator's missing-header reject path; `/health` returns HTTP 200 exempt; warn semantics per section 3.1 pass-with-skip if wrangler is missing or fails to bind).
+- 6 elicited parameters on `blueprint.json`: `access-application-host` (or `access-selfhosted-app-id`, exactly one required), `access-audience`, `access-jwks-url`, `access-policy-shape` (enum default `email-domain`), `access-bypass-service-auth-id` (blank disables break-glass).
+- `suggestedCompanions`: `logging` (for the metadata-only audit sink retention), `errorHandling` (for the validator failure boundary) and `secretsManagement` (for the paired break-glass service-auth secret).
+- Ships the shared `cf-edge` sample-app fixture at `packages/rcf-lite/test/fixtures/cf-edge/` (T-4 mints it per spec section 3.3). The fixture ships the applied Worker (`src/index.mjs`), the JWT validator (`src/jwt-validator.mjs`, sole reader of the `Cf-Access-Jwt-Assertion` header), a dependency-free RS256 fixture-JWT signer (`test/jwt-signer.mjs`) and a local JWKS server (`test/jwks-server.mjs`). No new rcf-lite runtime dependency (Node's built-in `crypto` module signs and verifies).
+- Extends `packages/rcf-lite/test/fixtures/probe-pack-application-admin-console/` with a `/admin/sign-in` route rendering the Access-gated surface (with `?caps=zeroTrustGate`) or the local-login surface (without). The extension rides `application-admin-console` v1.1.0.
+- Anatomy test at `packages/rcf-lite/test/blueprint/edge-cloudflare-access-anatomy.test.js` covers `TS-110..119` on the T-4 chain slice (blueprint shape, contributions cross-check, JWT validator behaviour, sole-reader guarantee, audit-event secrecy, break-glass posture, admin-console composition, fixture files, ADR bodies and clauses, guide sections and vendor URL).
+
+### Known limitations
+
+- The `real-account-gated-url` probe records `accountBoundSkipped: true` and aggregates to `pass` when `CI_HAS_CLOUDFLARE_ACCOUNT` or `CF_ACCESS_HOST` are unset (spec section 3.5 pass-with-skip). Full mechanism reach requires a CI environment with both env vars set and a deployed hostname behind an issued Zero Trust policy.
+- The v1.0.0 boundary defers per-path policy scope authoring, group-membership rule authoring and identity-provider federation to v1.1.0. The shipped validator observes the JWT's `groups` claim but does not enforce policy on it (the Cloudflare edge enforces before the request reaches the origin Worker); a future minor could ship a group-membership refinement.
+- The `wrangler-seam` probe warns (never fails) when `wrangler` is not installed under `packages/rcf-lite/test/fixtures/cf-edge/node_modules/.bin/wrangler`; a handler thrown at the workerd boundary is a genuine fail per the round-6 T-3 gate directive.
+- The Access-gated sign-in surface on `application-admin-console` v1.1.0 shows a placeholder principal email in the fixture (supplied via `?principalEmail=` or `ADMIN_CONSOLE_PRINCIPAL_EMAIL` env var). In a real deployment the principal reads from `request.auth.email` the JWT validator attaches; the fixture does not embed the validator (it renders the surface).

package/blueprints/edge-cloudflare-access/README.md

@@ -0,0 +1,141 @@
+# edge-cloudflare-access
+
+A rcf-lite blueprint that ships an opinionated wiring for Cloudflare
+Access as the edge authentication gate on a Workers project. One
+JWT validator middleware sits at the top of every fetch handler,
+verifies the JWT Cloudflare Access mints against the JWKS the
+service publishes, and reduces the principal onto `request.auth` as
+`{email, sub, groups}`. Every audit event carries only
+`{email, outcome, timestamp, path}`; no token slice, no header
+value beyond `path` ever leaves the validator boundary.
+
+- Version: `1.0.0`
+- Category: `edge`
+- Capabilities: `["zeroTrustGate"]`
+- Suggested companions: `logging`, `errorHandling`, `secretsManagement`
+
+## When to reach for it
+
+- Any Cloudflare Workers project that needs an authenticated edge
+  (only authenticated principals reach the origin Worker).
+- Any project that has adopted the Zero Trust posture and wants a
+  vendor-neutral seam (`request.auth`) between the edge and the
+  downstream handler.
+- Compose with `application-admin-console` v1.1.0 for the Access-gated
+  sign-in surface (round-4 T-4 capability-minor pattern).
+
+## The six REQs
+
+| REQ | What |
+| --- | --- |
+| `edge-cloudflare-access-REQ-001` | The JWT validator is the sole reader of the `Cf-Access-Jwt-Assertion` header and reduces the principal onto `request.auth`. |
+| `edge-cloudflare-access-REQ-002` | An Access application is declared with an elicited hostname or self-hosted-app id and an elicited policy shape from the enum. |
+| `edge-cloudflare-access-REQ-003` | The operator issues a Zero Trust policy via the guide's dashboard walk-through or the alternative API path. |
+| `edge-cloudflare-access-REQ-004` | The audit event carries only `{email, outcome, timestamp, path}` with no token value or headers. |
+| `edge-cloudflare-access-REQ-005` | Break-glass posture: an elicited bypass-service-auth pair authenticates CI automation. |
+| `edge-cloudflare-access-REQ-006` | Composition with `application-admin-console` v1.1.0: the sign-in surface flips per applied capability set. |
+
+## The wired shape
+
+The validator is the one place the `Cf-Access-Jwt-Assertion` header
+is read. Consumers reach the reduced principal via `request.auth`.
+The public surface is:
+
+```
+createAccessValidator({ env, eventSink, fetch?, clock?, bypassServiceAuth? })
+  -> { validate, middleware }
+```
+
+Where `env` carries the elicited `ACCESS_JWKS_URL` and `ACCESS_AUDIENCE`.
+The `middleware(request, envSwitches?)` returns either
+`{rejected: true, response, outcome}` for a 401 rejection or
+`{rejected: false, outcome}` after attaching `request.auth` in place.
+
+## Elicited parameters
+
+- `access-application-host` OR `access-selfhosted-app-id`: pick
+  exactly one at apply. The dashboard walk-through follows the
+  hostname path when the first is set and the self-hosted-app id
+  path when the second is set.
+- `access-audience`: the JWT audience tag the Access policy issues
+  the validator refuses tokens whose `aud` claim does not match.
+- `access-jwks-url`: the JWKS endpoint URL the validator fetches.
+  Cloudflare Access publishes this at
+  `https://<team>.cloudflareaccess.com/cdn-cgi/access/certs`.
+- `access-policy-shape` (default `email-domain`): one of
+  `email-domain`, `service-token-only`,
+  `service-token-plus-email-domain`, `group-membership`. Drives
+  the guide walk-through and the API alternative.
+- `access-bypass-service-auth-id`: leave blank to disable
+  break-glass. When set, the paired secret is delegated to the
+  applied `secretsManagement` companion via
+  `security-secrets-management`.
+
+## The six probes
+
+The probes live under `contributions/probes/`. Each has a matching
+`run-<probe-name>.mjs` shim that writes a per-blueprint report to
+`.rcf/reports/blueprints/edge-cloudflare-access/<probe-name>.json`
+under the fixture root.
+
+| Probe | anchorAcId | accountBound | What it covers |
+| --- | --- | --- | --- |
+| `jwt-validator-fixture.mjs` | `AC-34101-1` | false | Fixture-signed JWT validates; principal reduces to `{email, sub, groups}` on request.auth; one audit event with `outcome: validated` and allowed keys only. |
+| `jwt-validator-reject.mjs` | `AC-34102-1` | false | Three subcases: missing header, expired exp, mis-signed each return HTTP 401 with exactly one audit event whose keys are drawn from the allowed set; outcomes: `missing`, `expired`, `invalid`. |
+| `admin-console-gate-surface.mjs` | `AC-34108-1` | false | The extended admin-console fixture flips the sign-in surface: with `?caps=zeroTrustGate` it renders `[data-surface=access-gated]`; without it renders `[data-surface=local-login]`. Mutually exclusive on both branches. |
+| `audit-event-secrecy.mjs` | `AC-34106-1` | false | After 5 pass + 5 reject runs, the audit sink holds 10 metadata-only records; the serialised sink contains no substring of any JWT (or its segments) and no header names beyond `path`. |
+| `real-account-gated-url.mjs` | `AC-34109-1` | true | Fetch against a scheduled Access-configured hostname (`CF_ACCESS_HOST`) with `CI_HAS_CLOUDFLARE_ACCOUNT=true` follows the redirect chain to a `<team>.cloudflareaccess.com` URL. Records `accountBoundSkipped: true` without both env vars (pass-with-skip). |
+| `wrangler-seam.mjs` | `AC-34101-1` | false | Spawns `wrangler dev --local` on the cf-edge fixture. `/protected` returns HTTP 401 on the shipped validator's missing-header reject path (workerd boundary); `/health` returns HTTP 200 exempt. Warn semantics per section 3.1 pass-with-skip if wrangler is missing or fails to bind; a handler thrown at the workerd boundary is a fail. |
+
+## Mechanism-reach note
+
+- `AC-34101-1` (fixture JWT validate) and `AC-34102-1` (reject) are
+  covered by the in-process probes plus the wrangler-seam probe
+  under workerd.
+- `AC-34103-1` (sole-reader guarantee) is covered by the anatomy
+  test that greps `src/**/*.mjs` for the header string.
+- `AC-34104-1` (Access application declaration) is covered by the
+  anatomy test that reads `blueprint.json` for the elicits[] shape.
+- `AC-34105-1` (guide dashboard walk-through and API alternative)
+  is covered by the anatomy test that greps the shipped guide file
+  for the two section headings and the vendor URL.
+- `AC-34106-1` (audit metadata secrecy) is covered by the
+  `audit-event-secrecy` probe.
+- `AC-34107-1` (break-glass posture) is covered by the anatomy
+  test that drives the validator with an elicited pair.
+- `AC-34108-1` (admin-console composition) is covered by the
+  `admin-console-gate-surface` probe (both branches) and by the
+  shipped `application-admin-console.pack.mjs` pack check
+  `AC-21815-1` (Playwright-driven on the extended fixture).
+- `AC-34109-1` (real-account gated URL) is covered by the
+  `real-account-gated-url` probe (skipped in CI without both env
+  vars per section 3.5).
+
+## Two-line gate-reviewer boot
+
+```
+cd packages/rcf-lite/test/fixtures/cf-edge
+pnpm install --ignore-workspace
+```
+
+Then run every probe:
+
+```
+node ../../../../../blueprints/edge-cloudflare-access/contributions/probes/run-jwt-validator-fixture.mjs
+node ../../../../../blueprints/edge-cloudflare-access/contributions/probes/run-jwt-validator-reject.mjs
+node ../../../../../blueprints/edge-cloudflare-access/contributions/probes/run-audit-event-secrecy.mjs
+node ../../../../../blueprints/edge-cloudflare-access/contributions/probes/run-admin-console-gate-surface.mjs
+node ../../../../../blueprints/edge-cloudflare-access/contributions/probes/run-real-account-gated-url.mjs
+node ../../../../../blueprints/edge-cloudflare-access/contributions/probes/run-wrangler-seam.mjs
+```
+
+Each probe prints a report envelope and writes it to
+`.rcf/reports/blueprints/edge-cloudflare-access/<probe-name>.json`.
+
+## Composition companion
+
+- `application-admin-console` v1.1.0 consumes `zeroTrustGate`
+  optionally: the admin-console's sign-in surface renders
+  Access-gated when `zeroTrustGate` is in the applied set (and
+  falls back to `security-auth-*` local login otherwise). The
+  v1.1.0 minor rides this PR (round-4 T-4 capability-minor pattern).