rcf-lite 0.24.0 → 0.25.0

package/blueprints/edge-cloudflare-tunnel/CHANGELOG.md

@@ -0,0 +1,13 @@
+# edge-cloudflare-tunnel CHANGELOG
+
+## 1.0.0 - 2026-09-08
+
+Initial release. Round-7 T-3 of the Hetzner spec at `projects/blueprint-library/specs/hetzner-round-7-spec-2026-09-07.md`.
+
+- Mints capability `tunnelBridge` and global topic `edgeIngressBridge`.
+- Five REQs, eight USs, three TACs, three ADRs; five Node-only probes.
+- Extends the shared throwaway-Hetzner-server fixture with a cloudflared connector in both runtime shapes (compose-service alongside the T-2 web and caddy services when `containerHost` is applied; systemd-unit for a bare `cloudHost`) and both hostname modes (access-gated when `zeroTrustGate` is applied; public-hostname when absent) plus five `run-<probe>.mjs` delegate shims.
+- manifest-schema-validate carries five fixture-side mutation switches (`SIMULATE_MANIFEST_INVALID_TUNNEL_ID`, `SIMULATE_MANIFEST_CREDENTIALS_INLINE`, `SIMULATE_MANIFEST_MISSING_CATCHALL`, `SIMULATE_ORIGIN_PORT_OPEN`, `SIMULATE_EVENT_SECRECY_LEAK`); cloudflared-config-lint carries `SIMULATE_INGRESS_INVALID` and runs `cloudflared tunnel ingress validate` via the `cloudflare/cloudflared:2026.8.3` container when a local binary is not on PATH; aud-presence-check carries `SIMULATE_AUD_DROP`.
+- Mutation-discipline (T-2 gate ruling carried forward): every `SIMULATE_*` switch lives in the fixture-side delegate shim; the probe modules read only `RCF_LITE_T3_FIXTURE_ROOT` and never branch on being under mutation.
+- Connector-runtime choice elicited via `connector-runtime` (compose-service default when `containerHost` applied; systemd-unit alternative for bare `cloudHost`, per the vendor cloudflared as-a-service local-configuration-file docs); hostname-mode discovered (not elicited) from `appliedCapabilities` via the sidecar per ADR-4003.
+- Consumers: `w-2026-09-06-dave-010` follow-on (make the librarian API and workspace viewer reachable without Mullvad) is the estate consumer; blueprint acceptance never depends on that consumer, and the ops-01 migration mints as its own work item.

package/blueprints/edge-cloudflare-tunnel/README.md

@@ -0,0 +1,257 @@
+# edge-cloudflare-tunnel
+
+Round-7 T-3 core blueprint on the rcf-lite shelf. Bridges a service on a
+`cloudHost` (bare, systemd shape) or a `containerHost` (compose-service
+shape) to the Cloudflare edge through a Cloudflare Tunnel, with no
+public origin ports. When applied alongside `edge-cloudflare-access`
+(via the `zeroTrustGate` capability) the tunnel binds an Access AUD;
+when applied without it the tunnel serves in public-hostname mode.
+
+- Slug: `edge-cloudflare-tunnel`
+- Version: `1.0.0`
+- Category: `edge`
+- Capabilities: `["tunnelBridge"]`
+- Mints global topic: `edgeIngressBridge`
+- Contribution count: 5 REQs, 8 USs, 3 TACs, 3 ADRs, 5 probes
+- Consumers: ops-01 has no consumer today (SSH is the only inbound path). Estate consumer is the follow-on make-the-librarian-API-and-workspace-viewer-reachable-without-Mullvad work that `w-2026-09-06-dave-010` is expected to green-light. Blueprint acceptance never depends on that consumer; the ops-01 migration mints as a separate work item at that point (`w-2026-09-07-dave-004`).
+
+## Five REQs
+
+| Id | Contract |
+|---|---|
+| edge-cloudflare-tunnel-REQ-001 | Connector install shape switches on applied `containerHost` (compose-service default; systemd-unit for bare `cloudHost`); `cloudflaredReady` fires on boot with connector id, region and version metadata. |
+| edge-cloudflare-tunnel-REQ-002 | Tunnel manifest schema at `cloudflare/tunnels/<name>.yaml` (uuid tunnel id, `credentialsFile.secretRef` reference, ingress rules with catch-all `http_status:404`). |
+| edge-cloudflare-tunnel-REQ-003 | No public origin ports on the host; T-1 firewall stays closed on 80/443 unless a reverse proxy is applied; manifest refuses ingress rules whose service URL binds to a host public interface. |
+| edge-cloudflare-tunnel-REQ-004 | Access-gated composition: `zeroTrustGate` applied attaches `originRequest.access.aud`; absent omits the block and serves in public-hostname mode. |
+| edge-cloudflare-tunnel-REQ-005 | Credentials-file discipline (host mode 0o400, referenced via `secretRef`, not committed, grep-refuse, no leak in event bodies). |
+
+## Connector runtime shapes
+
+The connector runtime is elicited via `connector-runtime` (ADR-4002) with
+`recommendedDefault: compose-service`.
+
+- **compose-service** (default when `containerHost` is applied). The
+  cloudflared container ships alongside the applying project services on
+  the same web-net network. No host ports; restart `unless-stopped`;
+  logging driver aligned with the T-2 compose-host log-driver elicit.
+  Fixture: `packages/rcf-lite/test/fixtures/hetzner-throwaway-server/cloudflared/compose-service/`.
+- **systemd-unit** (alternative for a bare `cloudHost`). The cloudflared
+  binary is installed via the vendor package per the cloudflared
+  as-a-service documented systemd unit and runs as a systemd service
+  reading the local configuration file. Fixture:
+  `packages/rcf-lite/test/fixtures/hetzner-throwaway-server/cloudflared/systemd-unit/`.
+
+When to reach for which: pick compose-service when the project already
+runs docker compose on the host (natural home, same log driver, same
+restart discipline); pick systemd-unit when the host runs bare and there
+is no compose stack to add a service to (or when the project deliberately
+keeps cloudflared outside the compose lifecycle for boot ordering).
+
+## Tunnel manifest shape
+
+The manifest lives at `cloudflare/tunnels/<name>.yaml` under the
+applying project. The shipped JSON schema
+(`contributions/probes/tunnel-manifest.schema.json`) requires:
+
+- `tunnel`: uuid-shaped Cloudflare Tunnel id.
+- `credentialsFile.secretRef`: reference into `security-secrets-management`
+  (never a literal path or JSON body inline).
+- `ingress`: array of `{ hostname?, service, originRequest? }`. The last
+  entry MUST be a catch-all `service: http_status:404`. When the
+  Access-gated shape is applied every non-catch-all rule attaches
+  `originRequest.access.aud` with the AUD from the sidecar.
+
+Example (compose-service, public-hostname mode):
+
+```yaml
+tunnel: 00000000-0000-4000-8000-0000000012ab
+credentialsFile:
+  secretRef: hq-estate/CLOUDFLARE_TUNNEL_CREDENTIALS_MY_PROJECT
+ingress:
+  - hostname: my-app.example.com
+    service: http://web:8080
+  - service: http_status:404
+```
+
+Example (Access-gated shape adds one block per non-catch-all rule):
+
+```yaml
+ingress:
+  - hostname: my-app.example.com
+    service: http://web:8080
+    originRequest:
+      access:
+        aud: AUD-example-cloudflare-team
+        teamName: my-team
+        required: true
+  - service: http_status:404
+```
+
+## Credentials-file discipline
+
+The tunnel credentials JSON file lands on the host at mode 0o400 (owner
+read only). The manifest references it as a `credentialsFile.secretRef`;
+the fixture placeholder at
+`packages/rcf-lite/test/fixtures/hetzner-throwaway-server/cloudflared/*/credentials/probe.json.example`
+documents the pattern. The credentials file MUST NOT be committed to
+the applying project tree; a grep across the working tree for the
+tunnel id and account tag literals refuses on any tracked file. Every
+`cloudflaredReady`, `tunnelConnectorUp` and `ingressRuleReloaded` event
+body carries metadata only; the event-secrecy scan refuses on a body
+that mentions the credentials literal.
+
+Rotate credentials by rewriting the secret pointed to by `secretRef`
+and re-applying; the connector reloads on the next boot cycle.
+
+## Composition point (Access-gated vs public-hostname)
+
+The hostname mode is discovered from the applied capability set (not
+elicited; see ADR-4003). The blueprint reads the sidecar at
+`rcf/blueprints/edge-cloudflare-tunnel.applied.json` and inspects
+`appliedCapabilities`.
+
+- When `zeroTrustGate` is present (i.e. `edge-cloudflare-access` v1.0.0
+  is applied on the same project), every ingress rule attaches
+  `originRequest.access.aud` and cloudflared refuses at the edge any
+  request without a valid Access JWT for that AUD.
+- When `zeroTrustGate` is absent, the block is omitted and the tunnel
+  serves in public-hostname mode (open ingress on the public hostname;
+  authorization is whatever the origin service itself carries).
+
+The `aud-presence-check` probe refuses when the gated variant drifts to
+omit the AUD block (defensive against silent degradation).
+
+Graceful degrade: when Access is not applied (T-4 absent from
+`origin/main` or the applying project simply does not want the gate),
+the blueprint still ships in public-hostname mode. The probe assertion
+runs on both fixture variants so the shape flip is proven on every
+reviewer boot.
+
+## No-public-ports rule
+
+The T-1 firewall on a `cloudHost` allows 22 unconditionally and 80/443
+only when a reverse proxy is applied. A project applying only T-1 plus
+T-3 (no reverse proxy) declares zero 80/443 rules; the tunnel is the
+sole path from the edge to the origin. The manifest schema refuses
+ingress rules whose service URL binds to `0.0.0.0`, a non-loopback
+numeric IP, or an unresolvable shape.
+
+## Elicited parameters
+
+- `tunnel-name` (string; default `probe`): the Cloudflare Tunnel name
+  and the manifest filename under `cloudflare/tunnels/<name>.yaml`.
+- `cloudflare-zone-secret` (string; default `hq-estate/CLOUDFLARE_ZONE_ID`):
+  `security-secrets-management` reference to the Cloudflare zone the
+  tunnel serves under.
+- `public-hostname-template` (string; default `<service>.<zone>`):
+  template for the public hostname, expanded per ingress rule.
+- `ingress-rules` (string; default `[]`): ingress rules array (hostname
+  + service URL pairs).
+- `access-aud` (string; default empty): Access AUD tag for the gated
+  shape. Presence toggles the gated shape when `zeroTrustGate` is
+  applied.
+- `connector-runtime` (enum: `compose-service`, `systemd-unit`; default
+  `compose-service`): the connector runtime per ADR-4002.
+
+## Companions
+
+- `suggestedCompanions[logging]`: every `cloudflaredReady`,
+  `tunnelConnectorUp`, `tunnelConnectorDown`, `ingressRuleReloaded` and
+  `accessGateRefused` event writes through the applied logger.
+- `suggestedCompanions[errorHandling]`: a cloudflared exit, a JWT-check
+  failure, an ingress-rule schema violation, a hostname-DNS-route API
+  refusal constructs an internal error record.
+
+`providesRoles: []`.
+
+## Five probes
+
+Every probe writes its report envelope to
+`.rcf/reports/blueprints/edge-cloudflare-tunnel/<probe-name>.json`
+under the repo root.
+
+- **manifest-schema-validate** (local). Anchors AC-tunnel-manifestSchema,
+  AC-tunnel-noPublicOrigin, AC-tunnel-credentialsDiscipline. `accountBound: false`.
+  Ajv-free walker over the shipped JSON schema; runs on all four
+  variants; refuses on `SIMULATE_MANIFEST_INVALID_TUNNEL_ID`,
+  `SIMULATE_MANIFEST_CREDENTIALS_INLINE`, `SIMULATE_MANIFEST_MISSING_CATCHALL`,
+  `SIMULATE_ORIGIN_PORT_OPEN`, `SIMULATE_EVENT_SECRECY_LEAK`.
+- **cloudflared-config-lint** (local). Anchors AC-tunnel-hostnameRoutes.
+  `accountBound: false`. Runs `cloudflared tunnel --config <path> ingress validate`
+  via a local binary or the vendor container image
+  `cloudflare/cloudflared:2026.8.3`; refuses on `SIMULATE_INGRESS_INVALID`.
+- **aud-presence-check** (local). Anchors AC-tunnel-accessGated,
+  AC-tunnel-accessGatedRefuse. `accountBound: false`. Reads the sidecar
+  and the paired manifests; asserts the shape flips correctly; refuses
+  on `SIMULATE_AUD_DROP` when the gated fixture drifts to open ingress.
+- **real-account-connector-healthy** (account-bound). Anchors
+  AC-tunnel-connectorHealthy. `accountBound: true` on
+  `CI_HAS_CLOUDFLARE_ACCOUNT` AND `CI_HAS_HETZNER_ACCOUNT`. Without
+  both, records `accountBoundSkipped: true` and the aggregate flips to
+  `pass`.
+- **real-account-tunnel-hostname-routes** (account-bound). Anchors
+  AC-tunnel-hostnameRoutes (public sub-case) and AC-tunnel-accessGated
+  (gated sub-case). `accountBound: true`. The public-hostname sub-case
+  runs on `CI_HAS_CLOUDFLARE_ACCOUNT` + `CI_HAS_HETZNER_ACCOUNT`; the
+  access-gated sub-case adds `CI_HAS_CLOUDFLARE_ACCESS` per the round-7
+  Q4 ratification. Sub-cases skip independently.
+
+The delegate shims at
+`packages/rcf-lite/test/fixtures/hetzner-throwaway-server/run-<probe>.mjs`
+read the `SIMULATE_*` env vars and prepare mutated inputs in a scratch
+dir; the probe modules never read a `SIMULATE_` env var and never
+branch on being under mutation.
+
+## Two fixture variants times two hostname modes
+
+The fixture lives under
+`packages/rcf-lite/test/fixtures/hetzner-throwaway-server/cloudflared/`:
+
+- `compose-service/compose-fragment.yaml`: the cloudflared compose
+  service alongside the T-2 web and caddy services.
+- `systemd-unit/cloudflared.service`: the systemd unit per the vendor
+  as-a-service docs.
+- `<runtime>/cloudflare/tunnels/public-hostname.yaml`: manifest without
+  the AUD block.
+- `<runtime>/cloudflare/tunnels/access-gated.yaml`: manifest with the
+  AUD block on every non-catch-all rule.
+- `<runtime>/credentials/probe.json.example`: placeholder credentials
+  documenting the 0o400 mode discipline.
+- `sidecars/access-gated.applied.json`: `appliedCapabilities` includes
+  `zeroTrustGate`.
+- `sidecars/public-hostname.applied.json`: `appliedCapabilities`
+  excludes `zeroTrustGate`.
+
+Reviewer boot (mocked, no account) from the fixture directory:
+
+```
+cd packages/rcf-lite/test/fixtures/hetzner-throwaway-server
+node ./run-tunnel-manifest-schema-validate.mjs && node ./run-cloudflared-config-lint.mjs && node ./run-aud-presence-check.mjs
+```
+
+Reviewer boot (real account, throwaway server): set
+`CI_HAS_CLOUDFLARE_ACCOUNT=true` and `CI_HAS_HETZNER_ACCOUNT=true`
+(and `CI_HAS_CLOUDFLARE_ACCESS=true` for the gated sub-case) with the
+account tokens loaded via `security-secrets-management`, then invoke the
+two `run-real-account-*.mjs` scripts.
+
+## Composition on the shelf
+
+Consumes:
+- `platform-docker-compose-host` v1.0.0 (`containerHost` capability) for
+  the compose-service runtime path.
+- `deploy-hetzner-server` v1.0.0 (`cloudHost` capability) for the bare
+  systemd-unit runtime path.
+- `security-secrets-management` v1.0.1 (`secretsProvider` capability) for
+  the tunnel credentials `secretRef`.
+- Optionally `edge-cloudflare-access` v1.0.0 (`zeroTrustGate` capability)
+  for the Access-gated shape.
+
+Provides:
+- `tunnelBridge` (declared under `capabilities` on `blueprint.json`).
+- New global topic `edgeIngressBridge` on ADR-4001 (scope global).
+
+Conflict-by-design with future non-Cloudflare siblings on the
+`edgeIngressBridge` topic: Tailscale Funnel, Fly.io proxy, etc.
+would contribute the same topic string with a different mechanism.
+Round 7 ships only the Cloudflare Tunnel provider.

package/blueprints/edge-cloudflare-tunnel/blueprint.json

@@ -0,0 +1,168 @@
+{
+  "slug": "edge-cloudflare-tunnel",
+  "version": "1.0.0",
+  "category": "edge",
+  "capabilities": [
+    "tunnelBridge"
+  ],
+  "suggestedCompanions": [
+    {
+      "role": "logging",
+      "reason": "Every cloudflaredReady, tunnelConnectorUp, tunnelConnectorDown, ingressRuleReloaded and accessGateRefused event writes through the applied logger; a logging companion supplies the factory."
+    },
+    {
+      "role": "errorHandling",
+      "reason": "A cloudflared exit, a JWT-check failure, an ingress-rule schema violation, a hostname-DNS-route API refusal constructs an internal error record; an error-handling companion supplies the record factory and the boundary."
+    }
+  ],
+  "elicits": [
+    {
+      "id": "tunnel-name",
+      "prompt": "The Cloudflare Tunnel name (also the manifest filename under cloudflare/tunnels/<name>.yaml). Names the connector in cloudflared tunnel list and in the routing DNS entries.",
+      "kind": "string",
+      "default": "probe"
+    },
+    {
+      "id": "cloudflare-zone-secret",
+      "prompt": "security-secrets-management reference to the Cloudflare zone the tunnel serves under. Read at apply time to create the DNS route; never inlined into the manifest.",
+      "kind": "string",
+      "default": "hq-estate/CLOUDFLARE_ZONE_ID"
+    },
+    {
+      "id": "public-hostname-template",
+      "prompt": "Template for the public hostname (e.g. <service>.<zone>). The template is expanded per ingress rule at apply time.",
+      "kind": "string",
+      "default": "<service>.<zone>"
+    },
+    {
+      "id": "ingress-rules",
+      "prompt": "Ingress rules array: each entry names a public hostname and the internal service URL to route to. The last entry is a mandatory catch-all http_status 404 (added by the blueprint if omitted).",
+      "kind": "string",
+      "default": "[]"
+    },
+    {
+      "id": "access-aud",
+      "prompt": "Optional Access AUD tag for the Access-gated shape. When present AND edge-cloudflare-access is applied (zeroTrustGate on appliedCapabilities), every ingress rule attaches originRequest.access.aud with this value. When absent OR edge-cloudflare-access is not applied, the block is omitted and the tunnel serves in public-hostname mode.",
+      "kind": "string",
+      "default": ""
+    },
+    {
+      "id": "connector-runtime",
+      "prompt": "Connector runtime per ADR-4002. compose-service is the shipped default when containerHost is applied (T-2 platform-docker-compose-host on top of T-1 deploy-hetzner-server); systemd-unit is the alternative for a bare cloudHost per the cloudflared as-a-service local-configuration-file docs.",
+      "kind": "enum",
+      "options": [
+        "compose-service",
+        "systemd-unit"
+      ],
+      "default": "compose-service"
+    }
+  ],
+  "contributions": [
+    {
+      "id": "edge-cloudflare-tunnel-REQ-001",
+      "kind": "req",
+      "path": "requirements/edge-cloudflare-tunnel-req-001.json"
+    },
+    {
+      "id": "edge-cloudflare-tunnel-REQ-002",
+      "kind": "req",
+      "path": "requirements/edge-cloudflare-tunnel-req-002.json"
+    },
+    {
+      "id": "edge-cloudflare-tunnel-REQ-003",
+      "kind": "req",
+      "path": "requirements/edge-cloudflare-tunnel-req-003.json"
+    },
+    {
+      "id": "edge-cloudflare-tunnel-REQ-004",
+      "kind": "req",
+      "path": "requirements/edge-cloudflare-tunnel-req-004.json"
+    },
+    {
+      "id": "edge-cloudflare-tunnel-REQ-005",
+      "kind": "req",
+      "path": "requirements/edge-cloudflare-tunnel-req-005.json"
+    },
+    {
+      "id": "edge-cloudflare-tunnel-US-39101",
+      "kind": "us",
+      "path": "user-stories/edge-cloudflare-tunnel-us-39101.json"
+    },
+    {
+      "id": "edge-cloudflare-tunnel-US-39102",
+      "kind": "us",
+      "path": "user-stories/edge-cloudflare-tunnel-us-39102.json"
+    },
+    {
+      "id": "edge-cloudflare-tunnel-US-39103",
+      "kind": "us",
+      "path": "user-stories/edge-cloudflare-tunnel-us-39103.json"
+    },
+    {
+      "id": "edge-cloudflare-tunnel-US-39104",
+      "kind": "us",
+      "path": "user-stories/edge-cloudflare-tunnel-us-39104.json"
+    },
+    {
+      "id": "edge-cloudflare-tunnel-US-39105",
+      "kind": "us",
+      "path": "user-stories/edge-cloudflare-tunnel-us-39105.json"
+    },
+    {
+      "id": "edge-cloudflare-tunnel-US-39106",
+      "kind": "us",
+      "path": "user-stories/edge-cloudflare-tunnel-us-39106.json"
+    },
+    {
+      "id": "edge-cloudflare-tunnel-US-39107",
+      "kind": "us",
+      "path": "user-stories/edge-cloudflare-tunnel-us-39107.json"
+    },
+    {
+      "id": "edge-cloudflare-tunnel-US-39108",
+      "kind": "us",
+      "path": "user-stories/edge-cloudflare-tunnel-us-39108.json"
+    },
+    {
+      "id": "TAC-4001-edge-cloudflare-tunnel-connector-shape",
+      "kind": "tac",
+      "path": "tacs/tac-4001-edge-cloudflare-tunnel-connector-shape.json"
+    },
+    {
+      "id": "TAC-4002-edge-cloudflare-tunnel-manifest-schema",
+      "kind": "tac",
+      "path": "tacs/tac-4002-edge-cloudflare-tunnel-manifest-schema.json"
+    },
+    {
+      "id": "TAC-4003-edge-cloudflare-tunnel-access-binding",
+      "kind": "tac",
+      "path": "tacs/tac-4003-edge-cloudflare-tunnel-access-binding.json"
+    },
+    {
+      "id": "ADR-4001-edge-cloudflare-tunnel-ingress-bridge-contract",
+      "kind": "adr",
+      "path": "adrs/adr-4001-edge-cloudflare-tunnel-ingress-bridge-contract.json",
+      "scope": "global",
+      "topic": "edgeIngressBridge",
+      "recommendedDefault": true,
+      "elicited": false,
+      "standardsTraceClause": "Cloudflare Tunnel overview and get-started documented mechanics per hetzner-round-7-spec-2026-09-07.md"
+    },
+    {
+      "id": "ADR-4002-edge-cloudflare-tunnel-connector-runtime",
+      "kind": "adr",
+      "path": "adrs/adr-4002-edge-cloudflare-tunnel-connector-runtime.json",
+      "recommendedDefault": true,
+      "elicited": true,
+      "standardsTraceClause": "Cloudflare cloudflared as-a-service documented systemd unit per hetzner-round-7-spec-2026-09-07.md"
+    },
+    {
+      "id": "ADR-4003-edge-cloudflare-tunnel-hostname-mode",
+      "kind": "adr",
+      "path": "adrs/adr-4003-edge-cloudflare-tunnel-hostname-mode.json",
+      "recommendedDefault": true,
+      "elicited": false,
+      "standardsTraceClause": "Cloudflare Access self-hosted-public-app documented shape per hetzner-round-7-spec-2026-09-07.md"
+    }
+  ]
+}

package/blueprints/edge-cloudflare-tunnel/contributions/adrs/adr-4001-edge-cloudflare-tunnel-ingress-bridge-contract.json

@@ -0,0 +1,23 @@
+{
+  "adrId": "ADR-4001-edge-cloudflare-tunnel-ingress-bridge-contract",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "accepted",
+  "title": "Edge ingress bridge contract: Cloudflare Tunnel as the shipped ingress-bridge shape from a cloudHost service to the CF edge (scope global, new topic edgeIngressBridge)",
+  "context": "An applying project running on a Linux cloudHost needs one shipped answer to the question of how a service on that host reaches the public internet without opening origin ports. Round-7 T-3 mints the edgeIngressBridge topic on this ADR. Cloudflare Tunnel is the shipped v1.0.0 mechanism (cloudflared connector out to the CF edge; DNS route on a Cloudflare zone; ingress rules mapping public hostname to internal service URL). Every applied ingress bridge needs one project-wide answer to the edgeIngressBridge topic; a future non-Cloudflare sibling (Tailscale Funnel, Fly.io proxy) would contribute the same topic string with a different mechanism, forcing a DELIBERATE conflict the operator resolves per the round-2 conflict pattern. Standards trace clause: Cloudflare Tunnel overview and get-started documented mechanics per hetzner-round-7-spec-2026-09-07.md.",
+  "decision": "The shipped v1.0.0 default is a Cloudflare Tunnel connector as the edgeIngressBridge provider. A cloudflared connector on the applying host (compose service by default when containerHost is applied per ADR-4002; systemd unit on a bare cloudHost) reads a tunnel manifest at cloudflare/tunnels/<name>.yaml and terminates ingress at the CF edge. The edgeIngressBridge topic scope is global on this blueprint; the topic string is edgeIngressBridge (lower camelCase, one concept per topic, no version suffix, per the round-2 rules-for-new-topics clause on the shelf registry). Standards trace clause: Cloudflare Tunnel overview and get-started documented mechanics per hetzner-round-7-spec-2026-09-07.md.",
+  "consequences": "Consumer blueprints that expose a service publicly declare capabilities: [tunnelBridge] on their applied contract to know a bridge is in place. Composition with zeroTrustGate (edge-cloudflare-access) toggles the Access-gated ingress shape per ADR-4003. A T-3-only project (no reverse proxy) declares no 80/443 firewall rule; the tunnel is the sole path from the edge to the origin. Rebuild-from-manifest is always possible: the manifest is the source of truth, the running connector is derivative. Folding this shape into edge-cloudflare-access was rejected: Access is an authorisation gate, Tunnel is an ingress bridge; the responsibilities are distinct and one applies without the other.",
+  "alternativesConsidered": [
+    {
+      "name": "Fold into edge-cloudflare-access as an adapter",
+      "reason": "Access is an authorisation gate on top of an ingress; Tunnel is an ingress bridge. One applies without the other. Folding conflated two decisions the operator ships separately. Rejected per Baz ruling decision 21."
+    },
+    {
+      "name": "Ship a Tailscale Funnel or Fly.io proxy sibling in the same PR",
+      "reason": "Out of scope for round 7. Siblings mint on operator demand into their own reserved slots and conflict-by-design with this blueprint on the edgeIngressBridge topic."
+    }
+  ],
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/edge-cloudflare-tunnel/contributions/adrs/adr-4002-edge-cloudflare-tunnel-connector-runtime.json

@@ -0,0 +1,19 @@
+{
+  "adrId": "ADR-4002-edge-cloudflare-tunnel-connector-runtime",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "accepted",
+  "title": "Connector runtime: compose-service default when containerHost applied; systemd-unit alternative on bare cloudHost",
+  "context": "The cloudflared connector runs in one of two supported vendor shapes: as a container image published on the cloudflared downloads page, or as a systemd unit installed via the vendor package per the cloudflared as-a-service local-configuration-file docs. An applying project running its stack under docker compose has a natural home for the connector alongside its other services (same network, same logging driver, same restart policy). An applying project running bare on the host has no compose stack and needs a systemd unit for boot ordering and journald logging. Standards trace clause: Cloudflare cloudflared as-a-service documented systemd unit per hetzner-round-7-spec-2026-09-07.md.",
+  "decision": "The connector runtime is elicited via connector-runtime with enum {compose-service, systemd-unit} and recommendedDefault compose-service. When the containerHost capability is applied (T-2 platform-docker-compose-host) the shipped default is compose-service; when the host runs bare (only T-1 applied) the operator picks systemd-unit at apply time. Standards trace clause: Cloudflare cloudflared as-a-service documented systemd unit per hetzner-round-7-spec-2026-09-07.md.",
+  "consequences": "The fixture ships both variants and both pass the local probes (manifest-schema-validate, cloudflared-config-lint, aud-presence-check). A future non-Cloudflare tunnel sibling (Tailscale Funnel, Fly.io proxy) reuses the runtime enum shape but the elicit lives on that sibling own ADR (conflict-by-design on edgeIngressBridge per ADR-4001). The systemd variant carries an install caveat in the guide: the vendor package landed via apt or curl per the as-a-service docs, which is out of scope for the blueprint itself.",
+  "alternativesConsidered": [
+    {
+      "name": "Ship only the compose-service variant",
+      "reason": "A bare cloudHost is a valid apply shape; forcing docker compose onto a host that does not want it is a hard cost the elicit avoids."
+    }
+  ],
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/edge-cloudflare-tunnel/contributions/adrs/adr-4003-edge-cloudflare-tunnel-hostname-mode.json

@@ -0,0 +1,19 @@
+{
+  "adrId": "ADR-4003-edge-cloudflare-tunnel-hostname-mode",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "accepted",
+  "title": "Hostname mode: access-gated when zeroTrustGate applied (ingress attaches AUD); public-hostname when absent (block omitted)",
+  "context": "A tunnel can serve a public hostname openly (any request reaches the origin, protected only by whatever authentication the origin itself carries) or Access-gated (cloudflared refuses at the edge any request without a valid Access JWT for a named AUD, per the vendor self-hosted-public-app docs). The hostname mode is not elicited: it is DISCOVERED from the applied capability set. When zeroTrustGate is applied (edge-cloudflare-access v1.0.0), the tunnel binds the Access AUD; when it is not, the tunnel serves in public-hostname mode. Standards trace clause: Cloudflare Access self-hosted-public-app documented shape per hetzner-round-7-spec-2026-09-07.md.",
+  "decision": "ADR-4003 records the hostname mode as elicited: false and discovered from applied capabilities via the sidecar rcf/blueprints/edge-cloudflare-tunnel.applied.json. When appliedCapabilities includes zeroTrustGate, every ingress rule under the tunnel manifest attaches an originRequest.access block naming the AUD; when it does not, the block is omitted. The aud-presence-check probe runs on both fixture variants and asserts the shape flips correctly. Standards trace clause: Cloudflare Access self-hosted-public-app documented shape per hetzner-round-7-spec-2026-09-07.md.",
+  "consequences": "A project that applies zeroTrustGate later inherits the Access-gated shape on the next reapply of edge-cloudflare-tunnel without a manual manifest edit; a project that removes zeroTrustGate drops to public-hostname mode explicitly. A silent drift (the sidecar keeps zeroTrustGate but the ingress loses the AUD block) is caught by aud-presence-check refusing before the shape ships. Fixture variants live under cloudflared/sidecars/{access-gated,public-hostname}.applied.json; the SIMULATE_AUD_DROP mutation on the gated fixture proves the refuse path.",
+  "alternativesConsidered": [
+    {
+      "name": "Elicit the hostname mode as a separate parameter",
+      "reason": "The applied capability set is already the source of truth; a separate elicit would drift from that set. Discovery keeps the shape aligned by construction."
+    }
+  ],
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/edge-cloudflare-tunnel/contributions/probes/aud-presence-check.mjs

@@ -0,0 +1,114 @@
+// Probe: aud-presence-check.
+//
+// anchorAcId list:
+// - AC-tunnel-accessGated (primary)
+// - AC-tunnel-accessGatedRefuse (drift refuse)
+// accountBound: false.
+//
+// The probe reads the two sidecars under fixtureRoot()/sidecars and the
+// two manifests per runtime under fixtureRoot()/<runtime>/cloudflare/tunnels/<mode>.yaml.
+// A fixture-side delegate points FIXTURE_ROOT at a scratch copy to drive
+// the fixture-side aud-drop mutation. The probe module itself is a pure
+// function of the files it sees.
+//
+// Passes when:
+// - Each access-gated manifest carries originRequest.access.aud equal to
+//   the gated sidecar accessAud on every non-catch-all ingress rule.
+// - Each public-hostname manifest carries no originRequest.access block.
+//
+// Fails when the gated variant drifts to omit the AUD block (the drift-
+// refuse case). Also fails when the public-hostname variant carries an
+// AUD block (that shape has no source of authority).
+
+import { readFile } from 'node:fs/promises';
+import { resolve } from 'node:path';
+import { runShim, fixtureRoot, parseTunnelYaml, RUNTIMES } from './probe-utils.mjs';
+
+export const anchorAcIds = ['AC-tunnel-accessGated', 'AC-tunnel-accessGatedRefuse'];
+export const accountBound = false;
+
+async function loadSidecar(root, name) {
+  const path = resolve(root, 'sidecars', `${name}.applied.json`);
+  const text = await readFile(path, 'utf8');
+  return JSON.parse(text);
+}
+
+async function loadManifest(root, runtime, mode) {
+  const path = resolve(root, runtime, 'cloudflare/tunnels', `${mode}.yaml`);
+  const text = await readFile(path, 'utf8');
+  return parseTunnelYaml(text);
+}
+
+export default async function runProbe() {
+  const results = [];
+  const extra = { fixtureRoot: fixtureRoot() };
+  const root = fixtureRoot();
+  const gatedSidecar = await loadSidecar(root, 'access-gated');
+  const publicSidecar = await loadSidecar(root, 'public-hostname');
+  const gatedHasZtg = (gatedSidecar.appliedCapabilities ?? []).includes('zeroTrustGate');
+  const publicHasZtg = (publicSidecar.appliedCapabilities ?? []).includes('zeroTrustGate');
+  extra.gatedSidecarZtg = gatedHasZtg;
+  extra.publicSidecarZtg = publicHasZtg;
+  if (!gatedHasZtg) {
+    results.push({
+      anchorAcId: 'AC-tunnel-accessGated',
+      verdict: 'fail',
+      detail: `access-gated sidecar is missing zeroTrustGate in appliedCapabilities (found: ${(gatedSidecar.appliedCapabilities ?? []).join(', ')})`,
+    });
+  }
+  if (publicHasZtg) {
+    results.push({
+      anchorAcId: 'AC-tunnel-accessGated',
+      verdict: 'fail',
+      detail: `public-hostname sidecar unexpectedly names zeroTrustGate in appliedCapabilities (found: ${(publicSidecar.appliedCapabilities ?? []).join(', ')})`,
+    });
+  }
+  for (const runtime of RUNTIMES) {
+    // access-gated manifest: every non-catch-all rule attaches the AUD.
+    const gDoc = await loadManifest(root, runtime, 'access-gated');
+    const gRules = Array.isArray(gDoc.ingress) ? gDoc.ingress : [];
+    const gNonCatch = gRules.filter((r) => !String(r.service ?? '').startsWith('http_status:'));
+    const gAttached = gNonCatch.filter((r) => r?.originRequest?.access?.aud === gatedSidecar.accessAud);
+    if (gAttached.length === gNonCatch.length && gNonCatch.length > 0) {
+      results.push({
+        anchorAcId: 'AC-tunnel-accessGated',
+        verdict: 'pass',
+        detail: `${runtime}/access-gated: all ${gNonCatch.length} non-catch-all rule(s) attach originRequest.access.aud=${gatedSidecar.accessAud}`,
+      });
+    } else {
+      const missing = gNonCatch
+        .filter((r) => r?.originRequest?.access?.aud !== gatedSidecar.accessAud)
+        .map((r, i) => `service=${r.service} aud=${r?.originRequest?.access?.aud ?? '(none)'}`);
+      results.push({
+        anchorAcId: 'AC-tunnel-accessGatedRefuse',
+        verdict: 'fail',
+        detail: `${runtime}/access-gated: sidecar declares zeroTrustGate + accessAud=${gatedSidecar.accessAud} but ${gNonCatch.length - gAttached.length}/${gNonCatch.length} rule(s) drift (missing or wrong AUD). Drifted: ${missing.slice(0, 3).join(' | ')}`,
+      });
+    }
+    // public-hostname manifest: no rule carries originRequest.access.
+    const pDoc = await loadManifest(root, runtime, 'public-hostname');
+    const pRules = Array.isArray(pDoc.ingress) ? pDoc.ingress : [];
+    const carriers = pRules
+      .map((r, i) => ({ i, r }))
+      .filter(({ r }) => r?.originRequest?.access);
+    if (carriers.length === 0) {
+      results.push({
+        anchorAcId: 'AC-tunnel-accessGated',
+        verdict: 'pass',
+        detail: `${runtime}/public-hostname: manifest omits originRequest.access on every ingress rule (open ingress by design)`,
+      });
+    } else {
+      results.push({
+        anchorAcId: 'AC-tunnel-accessGated',
+        verdict: 'fail',
+        detail: `${runtime}/public-hostname: sidecar declares no zeroTrustGate but ${carriers.length} ingress rule(s) carry originRequest.access; that shape has no source of authority`,
+      });
+    }
+  }
+  return { results, extra };
+}
+
+const engine = { kind: 'sidecar-read', image: 'edge-cloudflare-tunnel aud-presence facade', healthy: true };
+if (import.meta.url === `file://${process.argv[1]}`) {
+  await runShim('aud-presence-check', engine, runProbe);
+}