rcf-lite 0.24.0 → 0.25.0

package/blueprints/edge-cloudflare-tunnel/contributions/probes/run-cloudflared-config-lint.mjs

@@ -0,0 +1,4 @@
+import runProbe from './cloudflared-config-lint.mjs';
+import { runShim, CLOUDFLARED_IMAGE } from './probe-utils.mjs';
+const engine = { kind: 'cloudflared-ingress-validate', image: CLOUDFLARED_IMAGE, healthy: true };
+runShim('cloudflared-config-lint', engine, runProbe);

package/blueprints/edge-cloudflare-tunnel/contributions/probes/run-manifest-schema-validate.mjs

@@ -0,0 +1,4 @@
+import runProbe from './manifest-schema-validate.mjs';
+import { runShim } from './probe-utils.mjs';
+const engine = { kind: 'schema-validate', image: 'edge-cloudflare-tunnel manifest schema (Ajv-free walker)', healthy: true };
+runShim('manifest-schema-validate', engine, runProbe);

package/blueprints/edge-cloudflare-tunnel/contributions/probes/run-real-account-connector-healthy.mjs

@@ -0,0 +1,4 @@
+import runProbe from './real-account-connector-healthy.mjs';
+import { runShim } from './probe-utils.mjs';
+const engine = { kind: 'real-account-connector-healthy', image: 'account-bound', healthy: true };
+runShim('real-account-connector-healthy', engine, runProbe);

package/blueprints/edge-cloudflare-tunnel/contributions/probes/run-real-account-tunnel-hostname-routes.mjs

@@ -0,0 +1,4 @@
+import runProbe from './real-account-tunnel-hostname-routes.mjs';
+import { runShim } from './probe-utils.mjs';
+const engine = { kind: 'real-account-tunnel-hostname-routes', image: 'account-bound', healthy: true };
+runShim('real-account-tunnel-hostname-routes', engine, runProbe);

package/blueprints/edge-cloudflare-tunnel/contributions/probes/tunnel-manifest.schema.json

@@ -0,0 +1,55 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://stravica.ai/schemas/edge-cloudflare-tunnel/tunnel-manifest.v1.json",
+  "title": "edge-cloudflare-tunnel tunnel manifest v1.0.0",
+  "type": "object",
+  "required": ["tunnel", "credentialsFile", "ingress"],
+  "additionalProperties": false,
+  "properties": {
+    "tunnel": {
+      "type": "string",
+      "pattern": "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$",
+      "description": "uuid-shaped Cloudflare Tunnel id per the vendor tunnel primitive"
+    },
+    "credentialsFile": {
+      "type": "object",
+      "required": ["secretRef"],
+      "additionalProperties": false,
+      "properties": {
+        "secretRef": {
+          "type": "string",
+          "minLength": 1,
+          "description": "security-secrets-management reference to the credentials JSON; never a literal path or JSON body"
+        }
+      }
+    },
+    "ingress": {
+      "type": "array",
+      "minItems": 1,
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "properties": {
+          "hostname": { "type": "string", "minLength": 1 },
+          "service": { "type": "string", "minLength": 1 },
+          "originRequest": {
+            "type": "object",
+            "additionalProperties": true,
+            "properties": {
+              "access": {
+                "type": "object",
+                "required": ["aud"],
+                "properties": {
+                  "aud": { "type": "string", "minLength": 1 },
+                  "teamName": { "type": "string" },
+                  "required": { "type": "boolean" }
+                }
+              }
+            }
+          }
+        },
+        "required": ["service"]
+      }
+    }
+  }
+}

package/blueprints/edge-cloudflare-tunnel/contributions/requirements/edge-cloudflare-tunnel-req-001.json

@@ -0,0 +1,18 @@
+{
+  "reqId": "edge-cloudflare-tunnel-REQ-001",
+  "prdId": "PRD-001",
+  "title": "Connector install shape switches on applied containerHost (compose-service default; systemd-unit for bare cloudHost); cloudflaredReady fires on boot",
+  "description": "The blueprint contributes a cloudflared connector whose runtime shape is elicited via ADR-4002 with enum {compose-service, systemd-unit} and recommendedDefault compose-service. When containerHost is applied (T-2 platform-docker-compose-host on top of T-1 deploy-hetzner-server) the connector ships as a compose service alongside the applying project services on the same web-net network. When the host runs bare (only T-1 applied) the connector ships as a systemd unit per the vendor local-configuration-file docs. Either shape emits cloudflaredReady on boot with connector id, region and version metadata (metadata only; no token or credentials in the payload).",
+  "category": "functional",
+  "domain": "edge",
+  "priority": "must",
+  "rationale": "Ratified in the Hetzner round 7 spec (2026-09-07 section 5.3 edge-cloudflare-tunnel-REQ-001). Ships as v1.0.0 of edge-cloudflare-tunnel.",
+  "tags": [
+    "blueprint:edge-cloudflare-tunnel",
+    "capability:tunnelBridge"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/edge-cloudflare-tunnel/contributions/requirements/edge-cloudflare-tunnel-req-002.json

@@ -0,0 +1,18 @@
+{
+  "reqId": "edge-cloudflare-tunnel-REQ-002",
+  "prdId": "PRD-001",
+  "title": "Tunnel manifest schema at cloudflare/tunnels/<name>.yaml under the applying project (uuid tunnel id, secretRef credentials, ingress rules with catch-all 404)",
+  "description": "The applying project ships one tunnel manifest per named tunnel at cloudflare/tunnels/<name>.yaml. The shipped JSON schema requires a uuid-shaped tunnel id, a credentials-file reference into security-secrets-management (secretRef, never a literal path or JSON body inline), and an ingress rules array whose last entry is a mandatory catch-all rule returning http_status 404. cloudflared refuses to boot when the manifest fails validation.",
+  "category": "functional",
+  "domain": "edge",
+  "priority": "must",
+  "rationale": "Ratified in the Hetzner round 7 spec (2026-09-07 section 5.3 edge-cloudflare-tunnel-REQ-002). Ships as v1.0.0 of edge-cloudflare-tunnel.",
+  "tags": [
+    "blueprint:edge-cloudflare-tunnel",
+    "capability:tunnelBridge"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/edge-cloudflare-tunnel/contributions/requirements/edge-cloudflare-tunnel-req-003.json

@@ -0,0 +1,18 @@
+{
+  "reqId": "edge-cloudflare-tunnel-REQ-003",
+  "prdId": "PRD-001",
+  "title": "No public origin ports on the host (T-1 firewall stays 22 open plus 80/443 only when a reverse proxy is applied; manifest refuses an origin-port request)",
+  "description": "The applying project MUST NOT open a public port on the host firewall for the origin path when only edge-cloudflare-tunnel provides ingress. T-1 deploy-hetzner-server firewall allows 22 unconditionally and 80/443 only when a reverse proxy is applied. A project applying only T-1 plus T-3 (no reverse proxy) declares zero 80/443 rules; the tunnel manifest schema refuses ingress rules whose service URL binds to a host public interface.",
+  "category": "functional",
+  "domain": "edge",
+  "priority": "must",
+  "rationale": "Ratified in the Hetzner round 7 spec (2026-09-07 section 5.3 edge-cloudflare-tunnel-REQ-003). Ships as v1.0.0 of edge-cloudflare-tunnel.",
+  "tags": [
+    "blueprint:edge-cloudflare-tunnel",
+    "capability:tunnelBridge"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/edge-cloudflare-tunnel/contributions/requirements/edge-cloudflare-tunnel-req-004.json

@@ -0,0 +1,18 @@
+{
+  "reqId": "edge-cloudflare-tunnel-REQ-004",
+  "prdId": "PRD-001",
+  "title": "Access-gated composition: when zeroTrustGate is applied, ingress rules attach originRequest.access.aud; when absent, block omitted and tunnel serves in public-hostname mode",
+  "description": "The blueprint reads the applying project sidecar rcf/blueprints/edge-cloudflare-tunnel.applied.json at apply time and inspects appliedCapabilities. When zeroTrustGate is present every ingress rule attaches an originRequest.access block naming the Access AUD; cloudflared refuses at the edge any request without a valid Access JWT for that AUD. When zeroTrustGate is absent the block is omitted and the tunnel serves in public-hostname mode. The aud-presence-check probe refuses if the shape drifts to open ingress on a project that intended the gated shape.",
+  "category": "functional",
+  "domain": "edge",
+  "priority": "must",
+  "rationale": "Ratified in the Hetzner round 7 spec (2026-09-07 section 5.3 edge-cloudflare-tunnel-REQ-004). Ships as v1.0.0 of edge-cloudflare-tunnel.",
+  "tags": [
+    "blueprint:edge-cloudflare-tunnel",
+    "capability:tunnelBridge"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/edge-cloudflare-tunnel/contributions/requirements/edge-cloudflare-tunnel-req-005.json

@@ -0,0 +1,18 @@
+{
+  "reqId": "edge-cloudflare-tunnel-REQ-005",
+  "prdId": "PRD-001",
+  "title": "Credentials-file discipline: JSON at mode 0o400, referenced via secretRef, not committed, grep-refuse on the literal, no leak in event bodies",
+  "description": "The tunnel credentials JSON file lands on the host at mode 0o400 (owner read only), is referenced from the manifest as a secretRef (never a literal committed file body), MUST NOT be committed to the applying project tree (grep-refuse on the tunnel id and account tag literals across the working tree), and MUST NOT appear in any cloudflaredReady, tunnelConnectorUp or ingressRuleReloaded event body.",
+  "category": "functional",
+  "domain": "edge",
+  "priority": "must",
+  "rationale": "Ratified in the Hetzner round 7 spec (2026-09-07 section 5.3 edge-cloudflare-tunnel-REQ-005). Ships as v1.0.0 of edge-cloudflare-tunnel.",
+  "tags": [
+    "blueprint:edge-cloudflare-tunnel",
+    "capability:tunnelBridge"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/edge-cloudflare-tunnel/contributions/tacs/tac-4001-edge-cloudflare-tunnel-connector-shape.json

@@ -0,0 +1,26 @@
+{
+  "tacId": "TAC-4001-edge-cloudflare-tunnel-connector-shape",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "name": "Edge-cloudflare-tunnel connector install shape",
+  "purpose": "The cloudflared connector installs in one of two runtime shapes as selected by ADR-4002 from the applied capability set. When containerHost is applied (T-2 platform-docker-compose-host on top of T-1 deploy-hetzner-server) the connector ships as a compose service alongside the applying project services on the same web-net network with no host ports and a healthcheck. When the host runs bare (only T-1 applied) the connector ships as a systemd unit per the vendor local-configuration-file docs. Either shape emits cloudflaredReady on boot with connector id, region and version metadata (metadata only).",
+  "responsibilities": [
+    "Ship the compose-service variant under packages/rcf-lite/test/fixtures/hetzner-throwaway-server/cloudflared/compose-service/ (AC-tunnel-connectorShape).",
+    "Ship the systemd-unit variant under packages/rcf-lite/test/fixtures/hetzner-throwaway-server/cloudflared/systemd-unit/ (AC-tunnel-connectorShape).",
+    "Emit cloudflaredReady on boot with connector id, region and version metadata (AC-tunnel-connectorHealthy).",
+    "Never expose an origin port on the host firewall (AC-tunnel-noPublicOrigin)."
+  ],
+  "internalStructure": "One module discovering the applied fixture root and returning both variant paths; consumers walk the compose fragment or the systemd unit file per the applied capability set.",
+  "interfaces": [
+    {
+      "name": "default export",
+      "kind": "facade",
+      "summary": "Connector shape discovery facade exported from the applied fixture module."
+    }
+  ],
+  "dependencies": [],
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/edge-cloudflare-tunnel/contributions/tacs/tac-4002-edge-cloudflare-tunnel-manifest-schema.json

@@ -0,0 +1,26 @@
+{
+  "tacId": "TAC-4002-edge-cloudflare-tunnel-manifest-schema",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "name": "Edge-cloudflare-tunnel manifest schema",
+  "purpose": "The tunnel manifest at cloudflare/tunnels/<name>.yaml under the applying project is the sole runtime source of truth for what the cloudflared connector serves. The shipped JSON schema requires a uuid-shaped tunnel id, a secretRef credentials reference (never a literal path or JSON body inline), and an ingress rules array whose last entry is a catch-all rule returning http_status 404. The schema refuses ingress rules whose service URL binds to a host public interface.",
+  "responsibilities": [
+    "Ship the JSON schema at contributions/probes/tunnel-manifest.schema.json (AC-tunnel-manifestSchema).",
+    "Validate the fixture manifests at cloudflared/*/cloudflare/tunnels/*.yaml on every reviewer boot (AC-tunnel-manifestSchema, AC-tunnel-hostnameRoutes).",
+    "Refuse ingress rules that bind to a host public port (AC-tunnel-noPublicOrigin).",
+    "Refuse a manifest whose credentials reference is not a secretRef (AC-tunnel-manifestSchema, AC-tunnel-credentialsDiscipline)."
+  ],
+  "internalStructure": "One JSON schema plus one probe module; the probe reads the resolved fixture root from env (defaulted to the canonical fixture path) and validates every tunnel yaml against the schema.",
+  "interfaces": [
+    {
+      "name": "default export",
+      "kind": "facade",
+      "summary": "Manifest schema-validate facade exported from the blueprint probe module."
+    }
+  ],
+  "dependencies": [],
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/edge-cloudflare-tunnel/contributions/tacs/tac-4003-edge-cloudflare-tunnel-access-binding.json

@@ -0,0 +1,25 @@
+{
+  "tacId": "TAC-4003-edge-cloudflare-tunnel-access-binding",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "name": "Edge-cloudflare-tunnel Access AUD binding",
+  "purpose": "The blueprint reads the applying project sidecar rcf/blueprints/edge-cloudflare-tunnel.applied.json at apply time and inspects appliedCapabilities. When zeroTrustGate is present every ingress rule attaches an originRequest.access.aud block naming the Access AUD; when absent the block is omitted and the tunnel serves in public-hostname mode. The shape is a pure function of the sidecar and never silently degrades to open ingress.",
+  "responsibilities": [
+    "Ship the aud-presence-check probe module (AC-tunnel-accessGated, AC-tunnel-accessGatedRefuse).",
+    "Ship both fixture variants (access-gated and public-hostname) under cloudflared/sidecars/*.applied.json (AC-tunnel-accessGated).",
+    "Refuse when the gated variant drifts to open ingress (AC-tunnel-accessGatedRefuse)."
+  ],
+  "internalStructure": "One probe module reading the sidecar file resolved from the fixture root and validating the ingress shape flips correctly.",
+  "interfaces": [
+    {
+      "name": "default export",
+      "kind": "facade",
+      "summary": "AUD-presence-check facade exported from the blueprint probe module."
+    }
+  ],
+  "dependencies": [],
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/edge-cloudflare-tunnel/contributions/user-stories/edge-cloudflare-tunnel-us-39101.json

@@ -0,0 +1,24 @@
+{
+  "usId": "edge-cloudflare-tunnel-US-39101",
+  "prdId": "PRD-001",
+  "reqId": "edge-cloudflare-tunnel-REQ-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Connector install shape switches on applied containerHost (compose-service default; systemd-unit fallback for bare cloudHost)",
+  "asA": "shelf consumer applying edge-cloudflare-tunnel v1.0.0 alongside deploy-hetzner-server (and optionally platform-docker-compose-host)",
+  "iWant": "the cloudflared connector to install as a compose service when the containerHost capability is applied and as a systemd unit when the host runs bare",
+  "soThat": "the runtime shape matches the applied platform rather than forcing a container onto a bare host or a bare service into a compose-managed stack",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-tunnel-connectorShape",
+      "description": "The applied fixture ships both variants under packages/rcf-lite/test/fixtures/hetzner-throwaway-server/cloudflared/{compose-service,systemd-unit}/; the compose-service variant defines a cloudflared service on the same web-net network as the T-2 web and caddy services with no host ports, restart unless-stopped and a healthcheck; the systemd-unit variant ships a cloudflared.service unit file per the vendor local-configuration-file docs.",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-4001-edge-cloudflare-tunnel-connector-shape"
+  ],
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/edge-cloudflare-tunnel/contributions/user-stories/edge-cloudflare-tunnel-us-39102.json

@@ -0,0 +1,24 @@
+{
+  "usId": "edge-cloudflare-tunnel-US-39102",
+  "prdId": "PRD-001",
+  "reqId": "edge-cloudflare-tunnel-REQ-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Cloudflared connector reports healthy on boot (tunnelConnectorUp fires with connector id, region, version)",
+  "asA": "shelf consumer applying edge-cloudflare-tunnel v1.0.0 on a cloudHost",
+  "iWant": "the connector to emit a tunnelConnectorUp event on boot with connector id, region and version metadata (metadata only)",
+  "soThat": "the observability sink proves the tunnel is up without a shell into the host",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-tunnel-connectorHealthy",
+      "description": "real-account-connector-healthy probe declares accountBound true (on CI_HAS_CLOUDFLARE_ACCOUNT AND CI_HAS_HETZNER_ACCOUNT) and records accountBoundSkipped when either is unset. When both are set the probe drives cloudflared tunnel info against the fixture tunnel and asserts at least one healthy connector plus a tunnelConnectorUp event with connector id, region and version.",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-4001-edge-cloudflare-tunnel-connector-shape"
+  ],
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/edge-cloudflare-tunnel/contributions/user-stories/edge-cloudflare-tunnel-us-39103.json

@@ -0,0 +1,24 @@
+{
+  "usId": "edge-cloudflare-tunnel-US-39103",
+  "prdId": "PRD-001",
+  "reqId": "edge-cloudflare-tunnel-REQ-002",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Tunnel manifest at cloudflare/tunnels/<name>.yaml validates on shape (uuid tunnel id, secretRef credentials, ingress with catch-all 404)",
+  "asA": "shelf consumer applying edge-cloudflare-tunnel v1.0.0",
+  "iWant": "the tunnel manifest to validate against a shipped JSON schema requiring a uuid-shaped tunnel id, a secretRef credentials reference, and an ingress rules array whose last entry is a mandatory catch-all http_status 404",
+  "soThat": "a mis-shaped manifest is caught at apply-time rather than at first inbound request",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-tunnel-manifestSchema",
+      "description": "manifest-schema-validate probe passes on the canonical fixture and fails when the fixture is mutated (SIMULATE_MANIFEST_INVALID_TUNNEL_ID, SIMULATE_MANIFEST_CREDENTIALS_INLINE, SIMULATE_MANIFEST_MISSING_CATCHALL) naming the offending field.",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-4002-edge-cloudflare-tunnel-manifest-schema"
+  ],
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/edge-cloudflare-tunnel/contributions/user-stories/edge-cloudflare-tunnel-us-39104.json

@@ -0,0 +1,24 @@
+{
+  "usId": "edge-cloudflare-tunnel-US-39104",
+  "prdId": "PRD-001",
+  "reqId": "edge-cloudflare-tunnel-REQ-002",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Cloudflared tunnel ingress validate exits 0 on the fixture manifest (routes public hostname to internal service URL)",
+  "asA": "shelf consumer applying edge-cloudflare-tunnel v1.0.0 with a compose service listening on an internal port",
+  "iWant": "the ingress rule mapping the public hostname to the internal service URL (http://web:8080 in the compose-service variant, http://127.0.0.1:8080 in the systemd-unit variant) to pass cloudflared tunnel ingress validate cleanly",
+  "soThat": "a rule that would fail at boot fails at gate instead",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-tunnel-hostnameRoutes",
+      "description": "cloudflared-config-lint probe runs cloudflared tunnel ingress validate against the fixture manifest (through the cloudflare/cloudflared:2026.8.3 container image when the binary is not on PATH) and exits 0 on the canonical fixture; SIMULATE_INGRESS_INVALID rewrites the service URL to an unresolvable scheme and the probe FAILS.",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-4002-edge-cloudflare-tunnel-manifest-schema"
+  ],
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/edge-cloudflare-tunnel/contributions/user-stories/edge-cloudflare-tunnel-us-39105.json

@@ -0,0 +1,24 @@
+{
+  "usId": "edge-cloudflare-tunnel-US-39105",
+  "prdId": "PRD-001",
+  "reqId": "edge-cloudflare-tunnel-REQ-003",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "No public origin ports on the host (firewall stays 22 open plus 80/443 only when a reverse proxy is applied; manifest refuses origin-port request)",
+  "asA": "shelf consumer applying edge-cloudflare-tunnel v1.0.0 without a reverse proxy",
+  "iWant": "the host firewall to stay closed on 80/443 and the manifest schema to refuse any ingress rule whose service URL binds to a host public interface",
+  "soThat": "the tunnel remains the only path from the edge to the origin",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-tunnel-noPublicOrigin",
+      "description": "manifest-schema-validate refuses under SIMULATE_ORIGIN_PORT_OPEN when an ingress rule service URL binds to 0.0.0.0 or a host public interface; the T-1 firewall on the ci-throwaway manifest stays 22 open plus 80/443 open only when a reverse proxy is applied.",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-4002-edge-cloudflare-tunnel-manifest-schema"
+  ],
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/edge-cloudflare-tunnel/contributions/user-stories/edge-cloudflare-tunnel-us-39106.json

@@ -0,0 +1,24 @@
+{
+  "usId": "edge-cloudflare-tunnel-US-39106",
+  "prdId": "PRD-001",
+  "reqId": "edge-cloudflare-tunnel-REQ-004",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Access-gated composition: zeroTrustGate applied attaches originRequest.access.aud; absent omits the block",
+  "asA": "shelf consumer applying edge-cloudflare-tunnel v1.0.0 alongside edge-cloudflare-access v1.0.0",
+  "iWant": "every ingress rule to attach an originRequest.access block naming the Access AUD when zeroTrustGate is applied and to omit the block when it is not",
+  "soThat": "the shape switches purely on the applied capability set and never silently degrades",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-tunnel-accessGated",
+      "description": "aud-presence-check probe reads each variant sidecar and asserts the ingress rules attach originRequest.access.aud on the access-gated variant and omit the block on the public-hostname variant. The shape flip is a pure function of the sidecar contents.",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-4003-edge-cloudflare-tunnel-access-binding"
+  ],
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/edge-cloudflare-tunnel/contributions/user-stories/edge-cloudflare-tunnel-us-39107.json

@@ -0,0 +1,24 @@
+{
+  "usId": "edge-cloudflare-tunnel-US-39107",
+  "prdId": "PRD-001",
+  "reqId": "edge-cloudflare-tunnel-REQ-004",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Access-gated shape does not silently degrade to open ingress when the AUD block drifts absent (aud-presence-check refuses)",
+  "asA": "shelf consumer who applied edge-cloudflare-tunnel v1.0.0 with zeroTrustGate on",
+  "iWant": "a probe that asserts the ingress rule keeps its originRequest.access.aud block on every reapply and refuses if the block drifts absent",
+  "soThat": "a silent config drift to open ingress is caught at gate rather than at first probing",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-tunnel-accessGatedRefuse",
+      "description": "aud-presence-check FAILS under SIMULATE_AUD_DROP when the gated fixture ingress drifts to omit the originRequest.access block. The finding names the affected rule and the missing AUD value.",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-4003-edge-cloudflare-tunnel-access-binding"
+  ],
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/edge-cloudflare-tunnel/contributions/user-stories/edge-cloudflare-tunnel-us-39108.json

@@ -0,0 +1,24 @@
+{
+  "usId": "edge-cloudflare-tunnel-US-39108",
+  "prdId": "PRD-001",
+  "reqId": "edge-cloudflare-tunnel-REQ-005",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Credentials-file discipline (0o400 host mode, secretRef, not committed, grep-refuse, no leak in event bodies)",
+  "asA": "shelf consumer applying edge-cloudflare-tunnel v1.0.0 on a cloudHost",
+  "iWant": "the tunnel credentials file to land at mode 0o400 on the host, be referenced from the manifest as a secretRef, never be committed to the applying tree (grep-refuse on the tunnel id and account tag literals), and never appear in any lifecycle event body",
+  "soThat": "a leaked credentials file cannot happen through a review-time miss",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-tunnel-credentialsDiscipline",
+      "description": "The fixture credentials placeholder documents the 0o400 host mode and secretRef pattern; the manifest references the credentials via a secretRef; the grep-refuse pattern is documented in the guide; every cloudflaredReady, tunnelConnectorUp and ingressRuleReloaded event body captured by the in-process facade carries metadata only, and SIMULATE_EVENT_SECRECY_LEAK inserts the credentials literal into a lifecycle event body and the scan FAILS naming the leaked field.",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-4002-edge-cloudflare-tunnel-manifest-schema"
+  ],
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/edge-cloudflare-tunnel/docs/topics.md

@@ -0,0 +1,72 @@
+# edge-cloudflare-tunnel blueprint coordination vocabulary
+
+This file is the edge-cloudflare-tunnel half of the cross-blueprint contract. The Phase 1 conflict detector matches scope:global ADR topics by EXACT string equality, and AC ids are unnamespaced by the 0.4.4 grammar. Any blueprint intended to compose with this one must reuse these exact strings and respect these bands.
+
+## Global ADR topics this blueprint contributes (exact strings)
+
+| Topic string | edge-cloudflare-tunnel contribution | Origin | Composition note |
+|---|---|---|---|
+| `edgeIngressBridge` | ADR-4001-edge-cloudflare-tunnel-ingress-bridge-contract | Minted by this blueprint. Names the wire-shape contract for the project-wide ingress-bridge from a `cloudHost` service to the CF edge; the shipped answer is a Cloudflare Tunnel connector (as a compose service by default when `containerHost` is applied; as a systemd unit for a bare `cloudHost` per the vendor cloudflared as-a-service local-configuration-file docs). | The one project-wide decision on how a service on a `cloudHost` reaches the public internet without opening origin ports. A future non-Cloudflare sibling (Tailscale Funnel, Fly.io proxy) would contribute the same topic string with a different mechanism, forcing a DELIBERATE conflict the operator resolves with a project-level ADR. |
+
+The edge-cloudflare-tunnel blueprint claims one global topic (minted here, shipped as the Cloudflare Tunnel connector bridge on a `cloudHost` or `containerHost`). ADR-4002 connector-runtime elicit and ADR-4003 hostname-mode discovered decision do not contribute global topics; a composing blueprint that holds an opinion on either authors its own project-level ADR.
+
+Rules for new topics: lower camel case, one concept per topic, no version suffixes. A topic names the decision area, not the chosen answer.
+
+## Id number bands (registry bootstrap)
+
+This table is maintained shelf-wide across every blueprint's `docs/topics.md`. Rows are recorded at ship, never predicted.
+
+| Blueprint | US band | ADR/TAC suffix block | Status | Global topics |
+|---|---|---|---|---|
+| application-spa | 1101-1899 | 2xx | shipped v1.3.0 | `clientRouting`, `theming`, `clientState`, `errorEnvelope`, `authModel` |
+| application-api-rest | 2101-2899 | 3xx | shipped v1.0.0 | `errorEnvelope`, `authModel`, `apiVersioning`, `logging` |
+| security-auth-magic-link | 3101-3899 | 5xx | shipped v1.2.0 | `authModel` |
+| email-smtp-resend | 4101-4899 | 4xx | shipped v1.0.0 | none |
+| hello-panel (walkthrough exemplar) | 4101-4899 | 4xx | doc-reserved; teaching exemplar in `packages/rcf-lite/docs/blueprint-authoring-walkthrough.md`, not shipped as a blueprint directory | `operatorPanel` |
+| persistence-data-sqlite | 5101-5899 | 6xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
+| delivery-ci-workflows | 6101-6899 | 7xx | shipped v2.0.0 (renamed from ci-pipeline) | `ciGates`, `strictCoverageGate`, `releaseArtefacts` |
+| observability-essentials | 7101-7899 | 8xx | shipped v2.0.0 | `statusPageContract` |
+| security-secrets-management | 8101-8899 | 9xx | shipped v1.0.1 | `secretsSource` |
+| security-auth-clerk | 9101-9899 | 10xx | shipped v1.0.0 | `authModel` |
+| security-auth-oauth2 | 10101-10899 | 11xx | shipped v1.0.0 | `authModel` |
+| security-auth-keycloak | 11101-11899 | 12xx | shipped v1.0.0 | `authModel` |
+| deploy-cloudflare-workers | 12101-12899 | 13xx | shipped v1.2.0 | `deploymentTarget` |
+| persistence-data-d1 | 13101-13899 | 14xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
+| observability-probe-endpoints | 14101-14899 | 15xx | shipped v1.1.0 | `healthProbes`, `readinessSemantics` |
+| observability-logging | 15101-15899 | 16xx | shipped v1.0.0 | `logging` |
+| application-error-handling | 16101-16899 | 17xx | shipped v1.0.0 | `errorHandling` |
+| application-datatable | 17101-17899 | 18xx | shipped v1.0.0 | none |
+| application-charts | 18101-18899 | 19xx | shipped v1.0.0 | none |
+| application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
+| application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
+| application-admin-console | 21101-21899 | 22xx | shipped v1.1.0 | `adminConsoleSignInSurface` |
+| application-empty-error-states | 22101-22899 | 23xx | shipped v1.0.0 | none |
+| application-file-upload | 23101-23899 | 24xx | shipped v1.0.0 | none |
+| application-forms-wizard | 24101-24899 | 25xx | shipped v1.0.0 | none |
+| application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
+| application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
+| persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
+| jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
+| platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |
+| platform-cloudflare-cron-triggers | 32101-32899 | 33xx | shipped v1.0.0 | `scheduledTriggerContract` |
+| platform-cloudflare-durable-objects | 33101-33899 | 34xx | shipped v1.0.0 | `strongConsistencyCellContract`, `websocketHubContract` |
+| edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
+| edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
+| edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
+| deploy-hetzner-server | 37101-37899 | 38xx | shipped v1.0.0 | `linuxCloudHostContract`, `snapshotAndBackupCadence` |
+| platform-docker-compose-host | 38101-38899 | 39xx | shipped v1.0.0 | `containerHostContract` |
+| edge-cloudflare-tunnel | 39101-39899 | 40xx | shipped v1.0.0 | `edgeIngressBridge` |
+
+US 39101-39108 sit at the LOW end of the 39101-39899 band on purpose (watchpost run-4 lesson). A project-side story mechanically derived from an edge-cloudflare-tunnel REQ id into the number 39108 would collide against the shipped US-39108; band headroom (39109-39899) leaves that space.
+
+Edge-cloudflare-tunnel suffixes for this blueprint use the 4001-4003 block, continuing the widening pattern (deploy-hetzner-server 3801-3804 for the T-1 sibling, platform-docker-compose-host 3901-3904 for the T-2 sibling).
+
+## Cross-references
+
+- `deploy-hetzner-server` (v1.0.0): consumed via `capabilities: [cloudHost]` for the bare systemd-unit connector runtime path.
+- `platform-docker-compose-host` (v1.0.0): consumed via `capabilities: [containerHost]` for the shipped default compose-service connector runtime path.
+- `security-secrets-management` (v1.0.1): the tunnel credentials file source resolves through the applied secrets facade when the secrets blueprint is applied; the guide names the `secretRef` shape.
+- `edge-cloudflare-access` (v1.0.0): optional composition on `capabilities: [zeroTrustGate]`; when applied, ingress rules attach originRequest.access.aud per ADR-4003.
+- `observability-logging`: the applied logging companion consumes every `cloudflaredReady`, `tunnelConnectorUp`, `tunnelConnectorDown`, `ingressRuleReloaded` and `accessGateRefused` event.