rcf-lite 0.24.0 → 0.25.0

package/rcf/requirements/req-130.json

@@ -0,0 +1,32 @@
+{
+  "createdAt": "2026-09-08T03:20:33.239Z",
+  "updatedAt": "2026-09-08T03:20:33.285Z",
+  "description": "The edge-cloudflare-tunnel v1.0.0 blueprint contributes a cloudflared connector whose runtime shape switches on the applied capability set: when the containerHost capability is applied (T-2 platform-docker-compose-host on top of T-1 deploy-hetzner-server), the connector ships as a compose service alongside the applying project's other services on the same web-net network; when the host runs bare (only T-1 applied), the connector ships as a systemd unit per the cloudflared as-a-service local-configuration-file docs. Either shape emits cloudflaredReady on boot with connector id, region and version metadata (metadata only; no token or tunnel credentials in the payload). Chain: HQ round-7 T-3 reserved-block per HQ chain-block ruling 2026-09-07 (REQ-130..139 / TS-160..169 / FBS-150..159 / CN-470..499). Round-7 T-3 track of hetzner-round-7-spec-2026-09-07 section 5.3.",
+  "reqId": "REQ-130",
+  "prdId": "PRD-001",
+  "title": "T-3 edge-cloudflare-tunnel v1.0.0 blueprint: cloudflared connector install shape (compose-service default on containerHost, systemd-unit alternative on bare cloudHost); cloudflaredReady fires on boot",
+  "category": "functional",
+  "domain": "functional",
+  "priority": "must",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [
+      "auth"
+    ],
+    "reason": "keyword-scan",
+    "classifiedAt": "2026-09-08T03:20:33.284Z",
+    "signals": [
+      {
+        "source": "description",
+        "shape": "auth",
+        "match": "token"
+      },
+      {
+        "source": "description",
+        "shape": "auth",
+        "match": "credential"
+      }
+    ]
+  }
+}

package/rcf/requirements/req-131.json

@@ -0,0 +1,54 @@
+{
+  "createdAt": "2026-09-08T03:20:33.475Z",
+  "updatedAt": "2026-09-08T03:20:33.520Z",
+  "description": "The applying project ships one tunnel manifest per named tunnel at cloudflare/tunnels/<name>.yaml. The schema requires: a tunnel id (uuid-shaped string), a credentials-file reference into security-secrets-management (secretRef, never a literal path or JSON body inline), and an ingress rules array mapping public hostname to internal service URL with a mandatory catch-all rule returning http_status 404. The manifest is the single source of truth for what the connector serves; cloudflared refuses to boot if it fails the shipped JSON-schema validation. Chain: HQ round-7 T-3 reserved-block per HQ chain-block ruling 2026-09-07. Round-7 T-3 track of hetzner-round-7-spec-2026-09-07 section 5.3.",
+  "reqId": "REQ-131",
+  "prdId": "PRD-001",
+  "title": "T-3 edge-cloudflare-tunnel v1.0.0 blueprint: tunnel manifest schema at cloudflare/tunnels/<name>.yaml (tunnel id, credentials secretRef, ingress rules with catch-all 404)",
+  "category": "functional",
+  "domain": "functional",
+  "priority": "must",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [
+      "httpApi",
+      "auth",
+      "persistence"
+    ],
+    "reason": "keyword-scan",
+    "classifiedAt": "2026-09-08T03:20:33.519Z",
+    "signals": [
+      {
+        "source": "title",
+        "shape": "persistence",
+        "match": "schema"
+      },
+      {
+        "source": "title",
+        "shape": "auth",
+        "match": "credential"
+      },
+      {
+        "source": "description",
+        "shape": "persistence",
+        "match": "schema"
+      },
+      {
+        "source": "description",
+        "shape": "auth",
+        "match": "credential"
+      },
+      {
+        "source": "description",
+        "shape": "httpApi",
+        "match": "JSON body"
+      },
+      {
+        "source": "description",
+        "shape": "persistence",
+        "match": "schema"
+      }
+    ]
+  }
+}

package/rcf/requirements/req-132.json

@@ -0,0 +1,27 @@
+{
+  "createdAt": "2026-09-08T03:20:33.710Z",
+  "updatedAt": "2026-09-08T03:20:33.755Z",
+  "description": "The applying project MUST NOT open a public port on the host firewall for the origin path when only edge-cloudflare-tunnel provides ingress. T-1 deploy-hetzner-server's firewall shape allows port 22 unconditionally and ports 80/443 only when a reverse proxy is applied on the host. A project that applies only T-1 plus T-3 (no reverse proxy) declares zero 80/443 firewall rules; the tunnel manifest schema check refuses the apply if an ingress rule tries to bind a port on the host directly (the ingress URL must reference an internal address, never the public interface). Chain: HQ round-7 T-3 reserved-block per HQ chain-block ruling 2026-09-07. Round-7 T-3 track of hetzner-round-7-spec-2026-09-07 section 5.3.",
+  "reqId": "REQ-132",
+  "prdId": "PRD-001",
+  "title": "T-3 edge-cloudflare-tunnel v1.0.0 blueprint: no public origin ports on the host (firewall stays 22 plus 80/443-only-when-reverse-proxy; manifest refuses if an origin port is asked for)",
+  "category": "functional",
+  "domain": "functional",
+  "priority": "must",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [
+      "persistence"
+    ],
+    "reason": "keyword-scan",
+    "classifiedAt": "2026-09-08T03:20:33.754Z",
+    "signals": [
+      {
+        "source": "description",
+        "shape": "persistence",
+        "match": "schema"
+      }
+    ]
+  }
+}

package/rcf/requirements/req-133.json

@@ -0,0 +1,20 @@
+{
+  "createdAt": "2026-09-08T03:20:33.944Z",
+  "updatedAt": "2026-09-08T03:20:33.990Z",
+  "description": "The blueprint reads the applying project's sidecar rcf/blueprints/edge-cloudflare-tunnel.applied.json at apply time and inspects appliedCapabilities. When zeroTrustGate is present (i.e. edge-cloudflare-access v1.0.0 has been applied on the same project), every ingress rule under the tunnel manifest attaches an originRequest.access block naming the Access AUD; cloudflared then refuses at the edge any request that arrives without a valid Access JWT for that AUD. When zeroTrustGate is absent, the block is omitted and the tunnel serves in public-hostname mode (open ingress on the public hostname). The aud-presence-check probe asserts the shape flips correctly on both fixture variants; the shape MUST NOT silently degrade to open ingress on a project that intended the gated shape. Chain: HQ round-7 T-3 reserved-block per HQ chain-block ruling 2026-09-07. Round-7 T-3 track of hetzner-round-7-spec-2026-09-07 section 5.3.",
+  "reqId": "REQ-133",
+  "prdId": "PRD-001",
+  "title": "T-3 edge-cloudflare-tunnel v1.0.0 blueprint: Access-gated composition (when zeroTrustGate is applied, the ingress rule sets originRequest.access.aud; when absent, the block is omitted and the tunnel serves in public-hostname mode)",
+  "category": "functional",
+  "domain": "functional",
+  "priority": "must",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [
+      "none"
+    ],
+    "reason": "keyword-scan",
+    "classifiedAt": "2026-09-08T03:20:33.989Z"
+  }
+}

package/rcf/requirements/req-134.json

@@ -0,0 +1,42 @@
+{
+  "createdAt": "2026-09-08T03:20:34.180Z",
+  "updatedAt": "2026-09-08T03:20:34.226Z",
+  "description": "The tunnel credentials file the cloudflared connector reads at boot MUST land on the host at mode 0o400 (owner read only), MUST be referenced from the tunnel manifest as a secretRef (never as a literal path to a committed file), MUST NOT be committed to the applying project's git tree (a grep across the working tree for the credentials-file body's uuid-shaped tunnel id and its account-tag literal refuses if either appears in a tracked file), and MUST NOT appear in any cloudflaredReady, tunnelConnectorUp or ingressRuleReloaded event body. A leaked credentials file gives an attacker lateral movement across every hostname the tunnel serves; the discipline is defensive against silent loss. Chain: HQ round-7 T-3 reserved-block per HQ chain-block ruling 2026-09-07. Round-7 T-3 track of hetzner-round-7-spec-2026-09-07 section 5.3.",
+  "reqId": "REQ-134",
+  "prdId": "PRD-001",
+  "title": "T-3 edge-cloudflare-tunnel v1.0.0 blueprint: credentials-file discipline (JSON at mode 0o400, referenced via security-secrets-management, not committed to the applying tree, grep-refuse on the literal)",
+  "category": "functional",
+  "domain": "functional",
+  "priority": "must",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [
+      "auth"
+    ],
+    "reason": "keyword-scan",
+    "classifiedAt": "2026-09-08T03:20:34.225Z",
+    "signals": [
+      {
+        "source": "title",
+        "shape": "auth",
+        "match": "credential"
+      },
+      {
+        "source": "description",
+        "shape": "auth",
+        "match": "credential"
+      },
+      {
+        "source": "description",
+        "shape": "auth",
+        "match": "credential"
+      },
+      {
+        "source": "description",
+        "shape": "auth",
+        "match": "credential"
+      }
+    ]
+  }
+}

package/rcf/tacs/tac-3801-deploy-hetzner-server-provisioner.json

@@ -0,0 +1,17 @@
+{
+  "createdAt": "2026-09-07T23:53:56.835Z",
+  "updatedAt": "2026-09-07T23:57:58.678Z",
+  "tacId": "TAC-3801-deploy-hetzner-server-provisioner",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "draft",
+  "purpose": "T-1 repo-chain TAC mirror for the shipped blueprints/deploy-hetzner-server/contributions/tacs/tac-3801-deploy-hetzner-server-provisioner.json contribution. Defines the provisioner Node module that wraps hcloud CLI verbs (create server, apply firewall, take snapshot, list snapshots, destroy server) and, under provisioningTool=raw-api, wraps the equivalent Hetzner Cloud REST endpoints. Sole-reader guarantee: only this module reads the HETZNER_ACCOUNT_API_KEY via security-secrets-management (or the project-scoped alternative). Anchors AC-11001-1 (repo chain).",
+  "responsibilities": [
+    "Wrap hcloud CLI verbs (create server, apply firewall, take snapshot, list snapshots, destroy server) and the raw Hetzner Cloud REST endpoints behind one facade (AC-11001-1, AC-11102-1, AC-11402-1).",
+    "Be the sole reader of HETZNER_ACCOUNT_API_KEY via security-secrets-management; every other module reads from the facade (AC-11001-1).",
+    "Emit provisionerReady, hetznerServerProvisioned, hetznerSnapshotTaken and hetznerServerDestroyed with metadata-only payloads (AC-11001-1, AC-11501-1)."
+  ],
+  "name": "deploy-hetzner-server provisioner module: sole reader of the Hetzner API token, hcloud shell path and raw-api fork",
+  "internalStructure": "One module blueprints/deploy-hetzner-server/contributions/tacs/tac-3801-deploy-hetzner-server-provisioner.json plus the provisioner facade proto shipped in the fixture (packages/rcf-lite/test/fixtures/hetzner-throwaway-server/src/provisioner-facade.mjs) reading the token from a single seam and firing provisionerReady on ready()."
+}

package/rcf/tacs/tac-3802-deploy-hetzner-server-manifest-schema.json

@@ -0,0 +1,17 @@
+{
+  "createdAt": "2026-09-07T23:53:57.022Z",
+  "updatedAt": "2026-09-07T23:57:58.866Z",
+  "tacId": "TAC-3802-deploy-hetzner-server-manifest-schema",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "draft",
+  "purpose": "T-1 repo-chain TAC mirror for the shipped blueprints/deploy-hetzner-server/contributions/tacs/tac-3802-deploy-hetzner-server-manifest-schema.json contribution. Defines the JSON Schema shape for the Hetzner server manifest under hetzner/servers/<name>.json: type, location, image, sshKeyIds, firewallId, networkId, cloudInitPath, labels, snapshotCadence. Anchors AC-11101-1 and AC-11102-1 (repo chain).",
+  "responsibilities": [
+    "Ship a draft-07 JSON Schema for the hetzner-server manifest (AC-11101-1, AC-11301-1, AC-11401-1).",
+    "Refuse on required-field violations (missing type, location, image, sshKeyIds, firewallId, cloudInitPath, labels or snapshotCadence).",
+    "Refuse on firewall-rule-shape violations (22 opened to 0.0.0.0/0, or 80/443 missing) (AC-11301-1)."
+  ],
+  "name": "deploy-hetzner-server server manifest schema and file layout at hetzner/servers/*.json",
+  "internalStructure": "One draft-07 JSON Schema at blueprints/deploy-hetzner-server/contributions/schemas/hetzner-server.schema.json and one shipped example manifest under the shared throwaway-server fixture (packages/rcf-lite/test/fixtures/hetzner-throwaway-server/hetzner/servers/ci-throwaway.json)."
+}

package/rcf/tacs/tac-3803-deploy-hetzner-server-cloud-init-template.json

@@ -0,0 +1,17 @@
+{
+  "createdAt": "2026-09-07T23:53:57.210Z",
+  "updatedAt": "2026-09-07T23:57:59.054Z",
+  "tacId": "TAC-3803-deploy-hetzner-server-cloud-init-template",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "draft",
+  "purpose": "T-1 repo-chain TAC mirror for the shipped blueprints/deploy-hetzner-server/contributions/tacs/tac-3803-deploy-hetzner-server-cloud-init-template.json contribution. Defines the cloud-init user-data template landing the six hardening baseline blocks: SSH key-only, root disabled, UFW default-deny incoming, DOCKER-USER iptables chain, fail2ban SSH jail, unattended-upgrades. Local render-lint asserts every block appears in the rendered YAML. Anchors AC-11201-1 and AC-11202-1 (repo chain).",
+  "responsibilities": [
+    "Ship a cloud-init user-data template that renders the six hardening baseline blocks (AC-11201-1, AC-11202-1).",
+    "Provide the render-lint check that asserts each block appears in the rendered YAML (AC-11201-1).",
+    "Cover the SIMULATE_HARDENING_DRIFT mutation with a probe FAILURE that names the missing line (AC-11201-1)."
+  ],
+  "name": "deploy-hetzner-server cloud-init template with the six hardening baseline blocks and render lint",
+  "internalStructure": "One template file at blueprints/deploy-hetzner-server/contributions/templates/cloud-init.yaml.tmpl and one render module at packages/rcf-lite/test/fixtures/hetzner-throwaway-server/src/cloud-init-renderer.mjs; the render-lint probe consumes the rendered output."
+}

package/rcf/tacs/tac-3804-deploy-hetzner-server-firewall-shape.json

@@ -0,0 +1,16 @@
+{
+  "createdAt": "2026-09-07T23:53:57.397Z",
+  "updatedAt": "2026-09-07T23:57:59.243Z",
+  "tacId": "TAC-3804-deploy-hetzner-server-firewall-shape",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "draft",
+  "purpose": "T-1 repo-chain TAC mirror for the shipped blueprints/deploy-hetzner-server/contributions/tacs/tac-3804-deploy-hetzner-server-firewall-shape.json contribution. Defines the Hetzner Cloud firewall rule shape carried inside the server manifest: 22 permitted only from an operator-nominated set of source-prefix ranges; 80/443 permitted from 0.0.0.0/0 for the reverse proxy; all other inbound denied. Manifest schema refuses on a rule set that opens 22 to 0.0.0.0/0 or drops 80/443. Anchors AC-11301-1 (repo chain).",
+  "responsibilities": [
+    "Define the firewall rule shape inside the manifest: 22 permitted only from a nonempty list of source-prefix ranges; 80 and 443 permitted; all other inbound denied (AC-11301-1).",
+    "Refuse (via manifest-schema-validate) on a manifest that opens 22 to 0.0.0.0/0 or drops 80/443."
+  ],
+  "name": "deploy-hetzner-server firewall rule shape: 22 from operator-nominated prefixes, 80/443 open, deny all else, applied at provision time",
+  "internalStructure": "Rule shape carried inside the same hetzner-server.schema.json used by TAC-3802; the applyFirewall verb on the provisioner facade consumes the parsed rule set."
+}

package/rcf/tacs/tac-3901-platform-docker-compose-host-compose-layout.json

@@ -0,0 +1,17 @@
+{
+  "createdAt": "2026-09-08T01:42:20.942Z",
+  "updatedAt": "2026-09-08T01:44:10.970Z",
+  "tacId": "TAC-3901-platform-docker-compose-host-compose-layout",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "draft",
+  "purpose": "The applying project ships one compose.yaml at the repo root whose services key names every container the stack runs. Every entry is one image running one container; networks and volumes are top-level named entries; a colocated .env carries non-secret configuration values (never inline). The container host reads compose.yaml as the runtime topology source and refuses to bring the stack up on layout drift.",
+  "responsibilities": [
+    "Serve compose.yaml at the repo root as the sole topology surface (AC-12001-1, AC-12202-1).",
+    "Guarantee service-per-container: each entry under services: runs one image (AC-12001-1).",
+    "Declare all networks and volumes as top-level named entries: no bare defaults (AC-12001-1).",
+    "Bind non-secret configuration through a colocated .env: no inline literals (AC-12001-1)."
+  ],
+  "name": "T-2 platform-docker-compose-host compose layout"
+}

package/rcf/tacs/tac-3902-platform-docker-compose-host-secrets-mount.json

@@ -0,0 +1,17 @@
+{
+  "createdAt": "2026-09-08T01:42:21.128Z",
+  "updatedAt": "2026-09-08T01:44:11.343Z",
+  "tacId": "TAC-3902-platform-docker-compose-host-secrets-mount",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "draft",
+  "purpose": "The compose file declares each secret under its top-level secrets: key with a file: source. Services reference secrets through their service-level secrets: array so docker mounts them as files at 0o400 inside the container. When security-secrets-management is applied, the source path resolves through that facade; when it is not, the guide names a file-based fallback. No plaintext secret literal appears anywhere in compose.yaml or a referenced service config (grep-refuse).",
+  "responsibilities": [
+    "Declare every secret through a compose secrets: file mount (AC-12101-1, AC-12102-1).",
+    "Refuse a plaintext secret literal anywhere in compose.yaml (AC-12102-1).",
+    "Mount each secret file at 0o400 inside the container (AC-12101-1).",
+    "Bind to security-secrets-management when applied; document the file-based fallback (AC-12101-1)."
+  ],
+  "name": "T-2 platform-docker-compose-host secrets mount"
+}

package/rcf/tacs/tac-3903-platform-docker-compose-host-healthcheck-lint.json

@@ -0,0 +1,17 @@
+{
+  "createdAt": "2026-09-08T01:42:21.313Z",
+  "updatedAt": "2026-09-08T01:44:11.716Z",
+  "tacId": "TAC-3903-platform-docker-compose-host-healthcheck-lint",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "draft",
+  "purpose": "A lint pass runs before docker compose up. It asserts every HTTP-terminating service declares a healthcheck: block; every service declares a restart: policy whose value is one of unless-stopped or on-failure; every service declares a logging: driver: entry whose value is one of journald or loki. The lint refuses on any missing or unclassified line, naming the service and the offending field.",
+  "responsibilities": [
+    "Assert every HTTP-terminating service declares a healthcheck: block (AC-12201-1).",
+    "Assert every service declares a restart policy in the allowed set (AC-12301-1).",
+    "Assert every service declares a logging driver in the allowed set (AC-12501-1).",
+    "Refuse on missing or unclassified fields, naming the service (AC-12201-1, AC-12301-1, AC-12501-1)."
+  ],
+  "name": "T-2 platform-docker-compose-host healthcheck and lifecycle lint"
+}

package/rcf/tacs/tac-3904-platform-docker-compose-host-reverse-proxy-artefact.json

@@ -0,0 +1,17 @@
+{
+  "createdAt": "2026-09-08T01:42:21.500Z",
+  "updatedAt": "2026-09-08T01:44:12.088Z",
+  "tacId": "TAC-3904-platform-docker-compose-host-reverse-proxy-artefact",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "draft",
+  "purpose": "The reverse-proxy config file (caddy/Caddyfile when reverseProxy=caddy, traefik/traefik.yaml when reverseProxy=traefik) lives as a first-class checked-in artefact under the applying repo. The compose file bind-mounts the artefact read-only into the proxy service. The gate runs the vendor validator against the artefact and refuses on an invalid directive. Under the reload verb (docker compose exec caddy caddy reload or the Traefik equivalent), a burst against the proxy inside the elicited window sees no non-2xx and no dropped connection.",
+  "responsibilities": [
+    "Ship the reverse-proxy config as a checked-in artefact bind-mounted into the proxy (AC-12401-1).",
+    "Validate the artefact with the vendor validator at gate time (AC-12401-1).",
+    "Prove zero-downtime reload with a real-account burst (AC-12402-1).",
+    "Name the reload verb per proxy in the guide and the fixture README (AC-12401-1, AC-12402-1)."
+  ],
+  "name": "T-2 platform-docker-compose-host reverse-proxy artefact"
+}

package/rcf/tacs/tac-4001-edge-cloudflare-tunnel-connector-shape.json

@@ -0,0 +1,17 @@
+{
+  "createdAt": "2026-09-08T03:23:08.838Z",
+  "updatedAt": "2026-09-08T03:23:08.838Z",
+  "tacId": "TAC-4001-edge-cloudflare-tunnel-connector-shape",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "draft",
+  "purpose": "The cloudflared connector installs in one of two runtime shapes as selected by ADR-4002 from the applied capability set. When containerHost is applied (T-2 platform-docker-compose-host on top of T-1 deploy-hetzner-server) the connector ships as a compose service alongside the applying project services on the same web-net network with no host ports and a healthcheck. When the host runs bare (only T-1 applied) the connector ships as a systemd unit per the vendor local-configuration-file docs. Either shape emits cloudflaredReady on boot with connector id, region and version metadata (metadata only).",
+  "responsibilities": [
+    "Ship the compose-service variant under packages/rcf-lite/test/fixtures/hetzner-throwaway-server/cloudflared/compose-service/ (AC-13001-1).",
+    "Ship the systemd-unit variant under packages/rcf-lite/test/fixtures/hetzner-throwaway-server/cloudflared/systemd-unit/ (AC-13001-1).",
+    "Emit cloudflaredReady on boot with connector id, region and version metadata (AC-13002-1).",
+    "Never expose an origin port on the host firewall (AC-13201-1)."
+  ],
+  "name": "edge-cloudflare-tunnel TAC"
+}

package/rcf/tacs/tac-4002-edge-cloudflare-tunnel-manifest-schema.json

@@ -0,0 +1,17 @@
+{
+  "createdAt": "2026-09-08T03:23:09.027Z",
+  "updatedAt": "2026-09-08T03:23:09.027Z",
+  "tacId": "TAC-4002-edge-cloudflare-tunnel-manifest-schema",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "draft",
+  "purpose": "The tunnel manifest at cloudflare/tunnels/<name>.yaml under the applying project is the sole runtime source of truth for what the cloudflared connector serves. The shipped JSON schema requires a uuid-shaped tunnel id, a secretRef credentials reference (never a literal path or JSON body inline), and an ingress rules array whose last entry is a catch-all rule returning http_status 404. The schema refuses ingress rules whose service URL binds to a host public interface (only internal addresses reachable through the compose network or a loopback interface are allowed).",
+  "responsibilities": [
+    "Ship the JSON schema at blueprints/edge-cloudflare-tunnel/contributions/probes/tunnel-manifest.schema.json (AC-13101-1).",
+    "Validate the fixture manifests at cloudflared/*/cloudflare/tunnels/probe.yaml on every reviewer boot (AC-13101-1, AC-13102-1).",
+    "Refuse ingress rules that bind to a host public port (AC-13201-1).",
+    "Refuse a manifest whose credentials reference is not a secretRef (AC-13101-1, AC-13401-1)."
+  ],
+  "name": "edge-cloudflare-tunnel TAC"
+}

package/rcf/tacs/tac-4003-edge-cloudflare-tunnel-access-binding.json

@@ -0,0 +1,16 @@
+{
+  "createdAt": "2026-09-08T03:23:09.218Z",
+  "updatedAt": "2026-09-08T03:23:09.218Z",
+  "tacId": "TAC-4003-edge-cloudflare-tunnel-access-binding",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "draft",
+  "purpose": "The blueprint reads the applying project sidecar rcf/blueprints/edge-cloudflare-tunnel.applied.json at apply time and inspects appliedCapabilities. When zeroTrustGate is present every ingress rule attaches an originRequest.access.aud block naming the Access AUD; when absent the block is omitted and the tunnel serves in public-hostname mode. The shape is a pure function of the sidecar and never silently degrades to open ingress.",
+  "responsibilities": [
+    "Ship the aud-presence-check probe module (AC-13301-1, AC-13302-1).",
+    "Ship both fixture variants (access-gated and public-hostname) under cloudflared/*/access-gated and cloudflared/*/public-hostname (AC-13301-1).",
+    "Refuse when the gated variant drifts to open ingress (AC-13302-1)."
+  ],
+  "name": "edge-cloudflare-tunnel TAC"
+}

package/rcf/test-suites/ts-140.json

@@ -0,0 +1,86 @@
+{
+  "createdAt": "2026-09-07T23:57:26.071Z",
+  "updatedAt": "2026-09-07T23:58:51.258Z",
+  "purpose": "Cover the T-1 chain ACs via the shipped anatomy test at test/blueprint/deploy-hetzner-server-anatomy.test.js and via the six blueprint probes driven from the shared throwaway-server fixture",
+  "testLevel": "integration",
+  "acIds": [
+    "AC-11001-1",
+    "AC-11101-1",
+    "AC-11102-1",
+    "AC-11201-1",
+    "AC-11202-1",
+    "AC-11301-1",
+    "AC-11401-1",
+    "AC-11402-1",
+    "AC-11501-1"
+  ],
+  "id": "TS-140",
+  "usId": "US-11001",
+  "title": "T-1 hetzner-server anatomy proof: probe modules and mocked fixture assertions",
+  "testCases": [
+    {
+      "id": "TC-140-provisioner-boot-and-sole-reader",
+      "acId": "AC-11001-1",
+      "description": "Cover AC-11001-1 via anatomy test: provisioner facade boot emits provisionerReady with metadata-only payload and only the facade reads the token",
+      "status": "pending",
+      "testPointer": "test/blueprint/deploy-hetzner-server-anatomy.test.js::T-1 deploy-hetzner-server AC-11001-1 provisioner boot and sole reader (TC-140)"
+    },
+    {
+      "id": "TC-140-manifest-schema-shape-valid",
+      "acId": "AC-11101-1",
+      "description": "Cover AC-11101-1 via anatomy test: hetzner-server.schema.json validates the fixture manifests",
+      "status": "pending",
+      "testPointer": "test/blueprint/deploy-hetzner-server-anatomy.test.js::T-1 deploy-hetzner-server AC-11101-1 manifest schema shape valid (TC-140-manifest-schema-shape-valid)"
+    },
+    {
+      "id": "TC-140-manifest-applies-mocked-provision",
+      "acId": "AC-11102-1",
+      "description": "Cover AC-11102-1 via anatomy test: mocked hcloud shell path returns id, primaryIpv4, location, serverType and hetznerServerProvisioned fires",
+      "status": "pending",
+      "testPointer": "test/blueprint/deploy-hetzner-server-anatomy.test.js::T-1 deploy-hetzner-server AC-11102-1 manifest applies to mocked provision (TC-140-manifest-applies-mocked-provision)"
+    },
+    {
+      "id": "TC-140-cloud-init-render-baseline-present",
+      "acId": "AC-11201-1",
+      "description": "Cover AC-11201-1 via anatomy test: rendered cloud-init YAML carries the six baseline blocks",
+      "status": "pending",
+      "testPointer": "test/blueprint/deploy-hetzner-server-anatomy.test.js::T-1 deploy-hetzner-server AC-11201-1 cloud-init render baseline present (TC-140-cloud-init-render-baseline-present)"
+    },
+    {
+      "id": "TC-140-cloud-init-hardened-account-bound-probe",
+      "acId": "AC-11202-1",
+      "description": "Cover AC-11202-1 via anatomy test: probe module manifest declares accountBound true and the fixture readme documents the ssh baseline checks",
+      "status": "pending",
+      "testPointer": "test/blueprint/deploy-hetzner-server-anatomy.test.js::T-1 deploy-hetzner-server AC-11202-1 cloud-init hardened account-bound probe declared (TC-140-cloud-init-hardened-account-bound-probe)"
+    },
+    {
+      "id": "TC-140-firewall-shape-valid-and-refuses-open-ssh",
+      "acId": "AC-11301-1",
+      "description": "Cover AC-11301-1 via anatomy test: schema accepts a rule set with 22 restricted plus 80/443 open and refuses an open-ssh mutation",
+      "status": "pending",
+      "testPointer": "test/blueprint/deploy-hetzner-server-anatomy.test.js::T-1 deploy-hetzner-server AC-11301-1 firewall shape valid and refuses open ssh (TC-140-firewall-shape-valid-and-refuses-open-ssh)"
+    },
+    {
+      "id": "TC-140-snapshot-cadence-enum",
+      "acId": "AC-11401-1",
+      "description": "Cover AC-11401-1 via anatomy test: snapshotCadence enum is weekly, daily, off",
+      "status": "pending",
+      "testPointer": "test/blueprint/deploy-hetzner-server-anatomy.test.js::T-1 deploy-hetzner-server AC-11401-1 snapshot cadence enum (TC-140-snapshot-cadence-enum)"
+    },
+    {
+      "id": "TC-140-snapshot-on-demand-account-bound-probe",
+      "acId": "AC-11402-1",
+      "description": "Cover AC-11402-1 via anatomy test: snapshot on-demand probe declares accountBound true and readme names the hcloud image list check",
+      "status": "pending",
+      "testPointer": "test/blueprint/deploy-hetzner-server-anatomy.test.js::T-1 deploy-hetzner-server AC-11402-1 snapshot on demand account-bound probe declared (TC-140-snapshot-on-demand-account-bound-probe)"
+    },
+    {
+      "id": "TC-140-lifecycle-events-metadata-only",
+      "acId": "AC-11501-1",
+      "description": "Cover AC-11501-1 via anatomy test: hcloud dry-run mock drives four lifecycle events, payloads carry only metadata fields, event-secrecy mutation FAILS",
+      "status": "pending",
+      "testPointer": "test/blueprint/deploy-hetzner-server-anatomy.test.js::T-1 deploy-hetzner-server AC-11501-1 lifecycle events metadata only (TC-140-lifecycle-events-metadata-only)"
+    }
+  ],
+  "status": "draft"
+}

package/rcf/test-suites/ts-150.json

@@ -0,0 +1,86 @@
+{
+  "createdAt": "2026-09-08T01:44:51.205Z",
+  "updatedAt": "2026-09-08T01:45:31.442Z",
+  "purpose": "Cover the T-2 chain ACs via the shipped anatomy test at test/blueprint/platform-docker-compose-host-anatomy.test.js and via the five blueprint probes driven from the shared throwaway-server fixture (which T-2 extends with a compose stack, Caddyfile, secret file mount and healthchecked service)",
+  "testLevel": "integration",
+  "acIds": [
+    "AC-12001-1",
+    "AC-12101-1",
+    "AC-12102-1",
+    "AC-12201-1",
+    "AC-12202-1",
+    "AC-12301-1",
+    "AC-12401-1",
+    "AC-12402-1",
+    "AC-12501-1"
+  ],
+  "id": "TS-150",
+  "usId": "US-12001",
+  "title": "T-2 platform-docker-compose-host anatomy proof: probe modules and compose-stack fixture assertions",
+  "testCases": [
+    {
+      "id": "TC-150-compose-layout-shape-valid",
+      "acId": "AC-12001-1",
+      "description": "Cover AC-12001-1 via anatomy test: fixture compose.yaml declares service-per-container, named networks and volumes, and a .env for non-secret config",
+      "status": "pending",
+      "testPointer": "test/blueprint/platform-docker-compose-host-anatomy.test.js::T-2 platform-docker-compose-host AC-12001-1 compose layout shape valid (TC-150-compose-layout-shape-valid)"
+    },
+    {
+      "id": "TC-150-secrets-file-mount-shape",
+      "acId": "AC-12101-1",
+      "description": "Cover AC-12101-1 via anatomy test: compose.yaml declares secrets under top-level secrets with a file source and mounts them into the web service; the mounted file is 0o400",
+      "status": "pending",
+      "testPointer": "test/blueprint/platform-docker-compose-host-anatomy.test.js::T-2 platform-docker-compose-host AC-12101-1 secrets file mount shape (TC-150-secrets-file-mount-shape)"
+    },
+    {
+      "id": "TC-150-secrets-scan-fails-on-plaintext",
+      "acId": "AC-12102-1",
+      "description": "Cover AC-12102-1 via anatomy test: secrets-as-files-scan probe passes on the canonical fixture and fails under SIMULATE_PLAINTEXT_SECRET naming the literal",
+      "status": "pending",
+      "testPointer": "test/blueprint/platform-docker-compose-host-anatomy.test.js::T-2 platform-docker-compose-host AC-12102-1 secrets-as-files scan fails on plaintext (TC-150-secrets-scan-fails-on-plaintext)"
+    },
+    {
+      "id": "TC-150-compose-config-lint-refuses-missing-healthcheck",
+      "acId": "AC-12201-1",
+      "description": "Cover AC-12201-1 via anatomy test: compose-config-lint probe passes on canonical fixture and fails under SIMULATE_MISSING_HEALTHCHECK naming the service",
+      "status": "pending",
+      "testPointer": "test/blueprint/platform-docker-compose-host-anatomy.test.js::T-2 platform-docker-compose-host AC-12201-1 compose-config-lint refuses missing healthcheck (TC-150-compose-config-lint-refuses-missing-healthcheck)"
+    },
+    {
+      "id": "TC-150-real-account-minimal-stack-up-declared-and-skipped-shape",
+      "acId": "AC-12202-1",
+      "description": "Cover AC-12202-1 via anatomy test: real-account-minimal-stack-up probe declares accountBound true and records accountBoundSkipped when the env var is unset",
+      "status": "pending",
+      "testPointer": "test/blueprint/platform-docker-compose-host-anatomy.test.js::T-2 platform-docker-compose-host AC-12202-1 real-account-minimal-stack-up declared and skipped shape (TC-150-real-account-minimal-stack-up-declared-and-skipped-shape)"
+    },
+    {
+      "id": "TC-150-restart-discipline-lint-refuses-unclassified",
+      "acId": "AC-12301-1",
+      "description": "Cover AC-12301-1 via anatomy test: compose-config-lint enforces restart policy classification and fails under SIMULATE_UNCLASSIFIED_RESTART naming the service",
+      "status": "pending",
+      "testPointer": "test/blueprint/platform-docker-compose-host-anatomy.test.js::T-2 platform-docker-compose-host AC-12301-1 restart discipline lint refuses unclassified (TC-150-restart-discipline-lint-refuses-unclassified)"
+    },
+    {
+      "id": "TC-150-caddyfile-validate-refuses-invalid-directive",
+      "acId": "AC-12401-1",
+      "description": "Cover AC-12401-1 via anatomy test: caddyfile-validate probe passes on canonical Caddyfile and fails under SIMULATE_INVALID_CADDYFILE naming the line",
+      "status": "pending",
+      "testPointer": "test/blueprint/platform-docker-compose-host-anatomy.test.js::T-2 platform-docker-compose-host AC-12401-1 caddyfile-validate refuses invalid directive (TC-150-caddyfile-validate-refuses-invalid-directive)"
+    },
+    {
+      "id": "TC-150-real-account-reload-burst-declared-and-skipped-shape",
+      "acId": "AC-12402-1",
+      "description": "Cover AC-12402-1 via anatomy test: real-account-reload-burst probe declares accountBound true and records accountBoundSkipped when the env var is unset",
+      "status": "pending",
+      "testPointer": "test/blueprint/platform-docker-compose-host-anatomy.test.js::T-2 platform-docker-compose-host AC-12402-1 real-account-reload-burst declared and skipped shape (TC-150-real-account-reload-burst-declared-and-skipped-shape)"
+    },
+    {
+      "id": "TC-150-log-driver-classification",
+      "acId": "AC-12501-1",
+      "description": "Cover AC-12501-1 via anatomy test: compose-config-lint asserts every service declares a logging driver and fails under SIMULATE_UNCLASSIFIED_LOG_DRIVER naming the service",
+      "status": "pending",
+      "testPointer": "test/blueprint/platform-docker-compose-host-anatomy.test.js::T-2 platform-docker-compose-host AC-12501-1 log driver classification (TC-150-log-driver-classification)"
+    }
+  ],
+  "status": "draft"
+}