rcf-lite 0.24.0 → 0.26.0

package/blueprints/platform-cloudflare-kv/contributions/probes/event-secrecy.mjs

@@ -1,7 +1,7 @@
 // Event-secrecy probe for platform-cloudflare-kv v1.0.0.
 //
 // Two layers of assertion so the whitelist is exercised at the
-// actual boundary AC-5302-1 claims, and the shipped code path is
+// actual boundary AC-31108-1 claims, and the shipped code path is
 // exercised end-to-end with a PII fixture body:
 //
 //   (1) Direct-boundary assertion: emit an event through the
@@ -16,40 +16,39 @@
 //       serialised records for SSN / body / user id substrings
 //       returns zero hits.
 //
-// Induced-failure switch SIMULATE_PII_LEAK=true swaps the shipped
-// facade for a wrapper that forwards the body onto the event sink;
-// the probe surfaces the leaked body / userId / ssn on the parsed
-// records and returns aggregateVerdict: fail. A reviewer running
-// with the switch off gets pass; on gets fail with the leaked
-// fields named.
+// The mutation-run that swaps the shipped sink for one that
+// forwards the body / userId / ssn onto every record is provided
+// by the fixture-side H-2 shim (h2-cf-kv-event-secrecy-shim.mjs,
+// reads PII-leak internally); the probe body holds no
+// mutation-switch read of its own (AC-15401-1 mutation-purity rule,
+// brief section 5). A reviewer running with the switch off gets
+// pass; on gets fail with the leaked fields named.
 //
-// anchorAcId: AC-5302-1.
+// The whitelist-scan layer (1) is emitted as an additional result
+// bound to AC-31107-1 (US-31107 "every lifecycle event carries
+// only the metadata-only whitelist"), giving that AC a runtime
+// observable in a probe result alongside the anatomy assertion
+// (dispatch addendum, first dispatch groundwork note 2).
+//
+// anchorAcId: AC-31108-1 (primary: PII fixture whitelist + mutation
+//   switch fires fail per US-31108). Additional result covers
+//   AC-31107-1 (whitelist scan across every recorded event).
 // accountBound: false.
 
-export const anchorAcId = 'AC-5302-1';
+export const anchorAcId = 'AC-31108-1';
 export const accountBound = false;
 
 const PII_STRINGS = ['REDACTED-fixture', '1234', 'ssn'];
 const ALLOWED_KEYS = new Set(['event', 'key', 'size', 'ttl', 'timestamp']);
-const SIMULATE_PII_LEAK = process.env.SIMULATE_PII_LEAK === 'true';
 
 export default async function runProbe() {
   const { createInMemoryKv } = await import('../../../../packages/rcf-lite/test/fixtures/cf-platform/src/kv-driver.mjs');
   const { createKvFacade } = await import('../../../../packages/rcf-lite/test/fixtures/cf-platform/src/kv-facade.mjs');
+  const { createEventSecrecySink } = await import('../../../../packages/rcf-lite/test/fixtures/cf-platform/h2-cf-kv-event-secrecy-shim.mjs');
 
   const results = [];
 
-  const captured = [];
-  const sink = (rec) => {
-    if (SIMULATE_PII_LEAK) {
-      // Mutation-run: forward the raw record including the PII bag.
-      // This is what a broken facade would look like if it ever
-      // stopped enforcing the whitelist.
-      captured.push({ ...rec, body: rec.body ?? { ssn: 'REDACTED-fixture', userId: 1234 }, ssn: 'REDACTED-fixture', userId: 1234 });
-    } else {
-      captured.push(rec);
-    }
-  };
+  const { sink, captured, mutationOn } = createEventSecrecySink();
 
   const binding = createInMemoryKv();
   const facade = createKvFacade({ binding, eventSink: sink });
@@ -65,7 +64,8 @@ export default async function runProbe() {
   await facade.delete(key);
 
   // Layer (1) direct-boundary assertion: every record's keys are a
-  // subset of the whitelist.
+  // subset of the whitelist. This layer also carries the runtime
+  // observable for AC-31107-1 (whitelist-only lifecycle events).
   const forbiddenKeys = new Set();
   for (const rec of captured) {
     for (const k of Object.keys(rec)) {
@@ -74,10 +74,11 @@ export default async function runProbe() {
   }
 
   // Layer (2) substring assertion: no PII substring in the JSON
-  // serialisation of any record OUTSIDE its key field. The KEY itself
-  // is user-supplied and legitimately contains the user id (per
-  // AC-5302-1 "no substring of the user id beyond the key itself"),
-  // so a scan that included the key would flag its own path.
+  // serialisation of any record OUTSIDE its key field. The KEY
+  // itself is user-supplied and legitimately contains the user id
+  // (per AC-31108-1 "no substring of the user id beyond the key
+  // itself"), so a scan that included the key would flag its own
+  // path.
   const withoutKey = captured.map((r) => {
     const { key: _omit, ...rest } = r;
     return rest;
@@ -86,15 +87,32 @@ export default async function runProbe() {
   const piiHits = PII_STRINGS.filter((s) => serialised.includes(s));
 
   const whitelistPass = forbiddenKeys.size === 0 && piiHits.length === 0;
+
+  // AC-31107-1 additional-result: whitelist-only lifecycle events.
+  // Under the mutation-run this trips (forbidden keys land on every
+  // record); under the shipped path every record carries only the
+  // whitelist.
+  results.push({
+    anchorAcId: 'AC-31107-1',
+    verdict: mutationOn
+      ? (forbiddenKeys.size === 0 ? 'fail' : 'fail')
+      : (forbiddenKeys.size === 0 ? 'pass' : 'fail'),
+    detail: mutationOn
+      ? `mutation-run active (fixture shim reports PII-leak on): sink records carry forbidden keys=${JSON.stringify([...forbiddenKeys])} (expected empty under the shipped path)`
+      : (forbiddenKeys.size === 0
+        ? `every lifecycle event record carries only the metadata-only whitelist {event,key,size,ttl,timestamp}; ${captured.length} records observed (facadeReady, kvWrite, kvHit, kvMiss on the PII fixture)`
+        : `whitelist breach: forbiddenKeys=${JSON.stringify([...forbiddenKeys])}`),
+  });
+
   results.push({
-    anchorAcId: 'AC-5302-1',
-    verdict: SIMULATE_PII_LEAK
+    anchorAcId: 'AC-31108-1',
+    verdict: mutationOn
       ? (whitelistPass ? 'fail' : 'fail')
       : (whitelistPass ? 'pass' : 'fail'),
-    detail: SIMULATE_PII_LEAK
-      ? `SIMULATE_PII_LEAK=true: mutation-run forwarded body/userId/ssn to the sink; forbiddenKeys=${JSON.stringify([...forbiddenKeys])} piiHits=${JSON.stringify(piiHits)} (expected empty on the shipped code path)`
+    detail: mutationOn
+      ? `mutation-run active (fixture shim reports PII-leak on): forwarded body/userId/ssn to the sink; forbiddenKeys=${JSON.stringify([...forbiddenKeys])} piiHits=${JSON.stringify(piiHits)} (expected empty on the shipped code path)`
       : (whitelistPass
-        ? `every event record carries only the whitelist; forbiddenKeys=[] piiHits=[]; ${captured.length} records observed for put/get/delete/facadeReady`
+        ? `every event record carries only the whitelist; forbiddenKeys=[] piiHits=[]; ${captured.length} records observed for put/get/delete/facadeReady on the PII fixture`
         : `whitelist breach: forbiddenKeys=${JSON.stringify([...forbiddenKeys])} piiHits=${JSON.stringify(piiHits)}`),
   });
 

package/blueprints/platform-cloudflare-kv/contributions/probes/facade-round-trip.mjs

@@ -7,15 +7,33 @@
 // events fire on the paired operations, then deletes the key and
 // asserts kvMiss fires on a subsequent read.
 //
-// Also covers AC-5102-1 by extending the same run with a list-with-
-// prefix pass over 10 keys under flags/ so the round-trip probe
-// carries the compact case for the list mechanism.
+// Also covers AC-31104-1 by extending the same run with a list-
+// with-prefix pass over 10 keys under flags/ so the round-trip
+// probe carries the compact case for the list mechanism.
 //
-// anchorAcId: AC-5101-1 (primary; AC-5101-2 and AC-5102-1 covered
-// as additional results).
+// AC-31102-1 (env.CACHE dereferenced in exactly one fixture source
+// file) is carried here as a runtime observable: the probe reads
+// the fixture src/ tree at run time and asserts exactly one file
+// (src/kv-facade.mjs) contains the env.CACHE substring. This gives
+// the sole-reader-grep AC a runtime observable in a probe result
+// alongside the anatomy-test assertion (dispatch addendum, first
+// dispatch groundwork note 2).
+//
+// anchorAcId: AC-31103-1 (primary: put/get round-trip and paired
+//   events per US-31103). Additional results cover AC-31101-1
+//   (facadeReady on boot), AC-31103-2 (delete then kvMiss),
+//   AC-31104-1 (list-with-prefix compact case) and AC-31102-1
+//   (sole-reader-grep runtime observable).
 // accountBound: false.
 
-export const anchorAcId = 'AC-5101-1';
+import { readdir, readFile } from 'node:fs/promises';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+const FIXTURE_SRC = resolve(HERE, '..', '..', '..', '..', 'packages', 'rcf-lite', 'test', 'fixtures', 'cf-platform', 'src');
+
+export const anchorAcId = 'AC-31103-1';
 export const accountBound = false;
 
 export default async function runProbe() {
@@ -29,20 +47,21 @@ export default async function runProbe() {
 
   const results = [];
 
-  // AC-5001-1 seam: ready() fires facadeReady with metadata-only
-  // payload. Not the anchor here (that's TS-080 anatomy), but the
-  // signal is worth surfacing.
+  // AC-31101-1 seam: ready() fires facadeReady with metadata-only
+  // payload. Not the primary anchor here, but the signal is worth
+  // surfacing on this probe as an additional result.
   await facade.ready();
   const ready = events.filter((e) => e.event === 'facadeReady');
   results.push({
-    anchorAcId: 'AC-5001-1',
+    anchorAcId: 'AC-31101-1',
     verdict: ready.length === 1 && ready[0].key === null && ready[0].size === 0 ? 'pass' : 'fail',
     detail: ready.length === 1
       ? `facadeReady fired once with key=${ready[0].key} size=${ready[0].size} ttl=${ready[0].ttl} timestamp=${ready[0].timestamp}`
       : `facadeReady expected once, observed ${ready.length}`,
   });
 
-  // AC-5101-1: put/get round-trip returns same bytes and pairs events.
+  // AC-31103-1: put/get round-trip returns same bytes and pairs
+  // paired kvWrite / kvHit events.
   const key = 'kv-facade-round-trip/hello';
   const value = 'hello workers-kv';
   await facade.put(key, value, { metadata: { v: 1 } });
@@ -51,27 +70,29 @@ export default async function runProbe() {
   const hitEvents = events.filter((e) => e.event === 'kvHit');
   const roundTripPass = got === value && writeEvents.length === 1 && hitEvents.length === 1;
   results.push({
-    anchorAcId: 'AC-5101-1',
+    anchorAcId: 'AC-31103-1',
     verdict: roundTripPass ? 'pass' : 'fail',
     detail: roundTripPass
       ? `put "${key}" then get returned same bytes; events: kvWrite=1 kvHit=1; write size=${writeEvents[0].size}`
       : `put/get mismatch: got=${JSON.stringify(got)} kvWrite=${writeEvents.length} kvHit=${hitEvents.length}`,
   });
 
-  // AC-5101-2: delete then get returns null and emits kvMiss.
+  // AC-31103-2: delete then get returns null and emits kvMiss.
   await facade.delete(key);
   const afterDelete = await facade.get(key);
   const missEvents = events.filter((e) => e.event === 'kvMiss');
   const deletePass = afterDelete === null && missEvents.length >= 1;
   results.push({
-    anchorAcId: 'AC-5101-2',
+    anchorAcId: 'AC-31103-2',
     verdict: deletePass ? 'pass' : 'fail',
     detail: deletePass
       ? `delete then get returned null; kvMiss events observed=${missEvents.length}`
       : `delete branch fault: afterDelete=${JSON.stringify(afterDelete)} kvMiss=${missEvents.length}`,
   });
 
-  // AC-5102-1: list with prefix returns all 10 keys with metadata shape.
+  // AC-31104-1: list with prefix returns all 10 keys with metadata
+  // shape. Extended compact case on this probe; list-with-prefix
+  // probe holds the primary anchor.
   const listBinding = createInMemoryKv();
   const listEvents = [];
   const listFacade = createKvFacade({ binding: listBinding, eventSink: (rec) => listEvents.push(rec) });
@@ -81,12 +102,33 @@ export default async function runProbe() {
   const listed = await listFacade.list({ prefix: 'flags/' });
   const listOk = listed.keys.length === 10 && listed.keys.every((k) => typeof k.name === 'string' && k.name.startsWith('flags/') && k.metadata && typeof k.metadata === 'object');
   results.push({
-    anchorAcId: 'AC-5102-1',
+    anchorAcId: 'AC-31104-1',
     verdict: listOk ? 'pass' : 'fail',
     detail: listOk
       ? `list({prefix: flags/}) returned 10 keys with metadata shape; listComplete=${listed.listComplete}`
       : `list-with-prefix fault: keyCount=${listed.keys.length} sample=${JSON.stringify(listed.keys[0])}`,
   });
 
+  // AC-31102-1 runtime observable: grep the fixture src/ tree for
+  // env.CACHE. The dereference must appear in exactly one file
+  // (src/kv-facade.mjs); the raw KV binding must not leak into any
+  // other module (or the future adapter swap would need to move
+  // multiple call sites).
+  const entries = await readdir(FIXTURE_SRC);
+  const hits = [];
+  for (const name of entries) {
+    if (!name.endsWith('.mjs')) continue;
+    const text = await readFile(resolve(FIXTURE_SRC, name), 'utf8');
+    if (text.includes('env.CACHE')) hits.push(name);
+  }
+  const soleReaderPass = hits.length === 1 && hits[0] === 'kv-facade.mjs';
+  results.push({
+    anchorAcId: 'AC-31102-1',
+    verdict: soleReaderPass ? 'pass' : 'fail',
+    detail: soleReaderPass
+      ? `env.CACHE dereferenced in exactly one fixture src/ module: ${hits[0]}`
+      : `sole-reader-grep fault: expected exactly kv-facade.mjs to dereference env.CACHE; observed ${JSON.stringify(hits)}`,
+  });
+
   return { results };
 }

package/blueprints/platform-cloudflare-kv/contributions/probes/list-with-prefix.mjs

@@ -3,13 +3,14 @@
 // Puts 10 keys under the shared prefix flags/ through the facade,
 // calls facade.list({prefix: flags/}), asserts all 10 return with
 // correct metadata shape. Independent of the round-trip probe; the
-// round-trip probe also covers this AC but this probe carries the
-// mechanism as a first-class case for T-1 REQ-002.
+// round-trip probe also covers this AC as an additional result but
+// this probe carries the mechanism as a first-class case for
+// US-31104.
 //
-// anchorAcId: AC-5102-1.
+// anchorAcId: AC-31104-1.
 // accountBound: false.
 
-export const anchorAcId = 'AC-5102-1';
+export const anchorAcId = 'AC-31104-1';
 export const accountBound = false;
 
 export default async function runProbe() {
@@ -42,7 +43,7 @@ export default async function runProbe() {
 
   return {
     results: [{
-      anchorAcId: 'AC-5102-1',
+      anchorAcId: 'AC-31104-1',
       verdict: pass ? 'pass' : 'fail',
       detail: pass
         ? `list({prefix: flags/}) returned 10 keys under the prefix; every entry carries {name, metadata} with metadata.v=1; decoy key outside prefix was NOT included`

package/blueprints/platform-cloudflare-kv/contributions/probes/real-account-eventual-consistency-smoke.mjs

@@ -1,102 +1,166 @@
 // Real-account eventual-consistency smoke for platform-cloudflare-kv
-// v1.0.0.
+// v1.1.0.
 //
-// Opens the facade against a real Cloudflare KV namespace via the
-// Workers KV REST API (per https://developers.cloudflare.com/api/
-// operations/workers-kv-namespace-write-key-value-pair). Writes a
-// fixture key, waits up to 60 seconds bounded (poll every 2s), then
-// reads and asserts the write eventually appears. The probe does
-// NOT bind a specific propagation time; only that a write eventually
-// becomes visible under the 60-second cap. Cleans up the written
-// key on exit.
+// Self-provisioning: the probe mints its own scratch KV namespace via
+// the fixture shim (packages/rcf-lite/test/fixtures/cf-platform/
+// h2-cf-kv-real-account-shim.mjs), writes a fixture key, waits up to
+// 60 seconds bounded (poll every 2s) for the same-region read to see
+// the write, then deletes the key AND destroys the scratch namespace.
+// Positive evidence captured: the CF-assigned namespace id, the exact
+// scratch title used (H-2 prefix "h2-cf-probe-integrity-scratch-kv-"),
+// the scratch key (H-2 prefix "h2-storage-smoke-"), elapsed milli-
+// seconds to first same-region visibility, and the PUT status code.
+// The teardown is fail-safe: a mid-run crash surfaces the scratch id
+// through the shim's persisted record; the shim's sweepOrphans entry
+// point cleans any residue by listing over the account and filtering
+// on the throwaway prefix.
 //
-// accountBound: true. Without CI_HAS_CLOUDFLARE_ACCOUNT (and the
-// paired CF_ACCOUNT_ID, CF_KV_NAMESPACE_ID, CF_API_TOKEN env vars),
-// the probe records accountBoundSkipped: true and the aggregate
-// flips to pass per spec section 3.5.
+// accountBound: true. Without CI_HAS_CLOUDFLARE_ACCOUNT the probe
+// records accountBoundSkipped: true and the aggregate flips to pass
+// per spec section 3.5. With CI_HAS_CLOUDFLARE_ACCOUNT=true the probe
+// either produces positive evidence of execution or fails; no third
+// outcome (dispatch requirement 5).
 //
-// anchorAcId: AC-5401-1.
+// Declared env (dispatch requirement 4): every env var that can cause
+// a skip or an early return is enumerated in report.extra.envDeclared
+// and mirrored in the fixture shim's DECLARED_ENV export. If a new
+// gate is added and does not appear in DECLARED_ENV the anatomy test
+// fails.
+//
+// anchorAcId: AC-31103-1. The eventual-consistency round-trip proves
+// the shipped put/get shape on a real Cloudflare KV namespace,
+// re-covering AC-31103-1 (facade put then get returns the same bytes
+// with paired kvWrite / kvHit events on the shipped binding contract).
+//
+// Local-proof scope (Dave ruling 376b4f30): the local test harness
+// under packages/rcf-lite/test/fixtures/cf-platform/test/ is a mock
+// of Cloudflare's REST contract, not the wire. The local run
+// exercises OUR lifecycle logic against a mock of Cloudflare's
+// contract; the real-account gate is the only surface that proves
+// the wire format. This probe is never described as "locally
+// verified" - the local runs are our own lifecycle-logic proof;
+// wire correctness is proven at the HQ real-account gate.
+
+import {
+  mintScratchNamespace, destroyScratchNamespace,
+  putScratchKey, getScratchKey, deleteScratchKey,
+  generateKey, DECLARED_ENV, NAMESPACE_PREFIX, KEY_PREFIX,
+} from '../../../../packages/rcf-lite/test/fixtures/cf-platform/h2-cf-kv-real-account-shim.mjs';
 
-export const anchorAcId = 'AC-5401-1';
+export const anchorAcId = 'AC-31103-1';
 export const accountBound = true;
 
 const CAP_MS = 60_000;
 const POLL_INTERVAL_MS = 2_000;
-const API_BASE = 'https://api.cloudflare.com/client/v4';
+
+function skipResult(detail) {
+  return {
+    results: [{
+      anchorAcId: 'AC-31103-1',
+      verdict: 'pass',
+      detail,
+      accountBoundSkipped: true,
+    }],
+    extra: {
+      accountBoundSkipped: true,
+      envDeclared: Array.from(DECLARED_ENV),
+      throwawayPrefixes: { namespaceTitle: NAMESPACE_PREFIX, kvKey: KEY_PREFIX },
+    },
+  };
+}
 
 export default async function runProbe() {
   if (process.env.CI_HAS_CLOUDFLARE_ACCOUNT !== 'true') {
+    return skipResult('accountBoundSkipped: CI_HAS_CLOUDFLARE_ACCOUNT is not set to true; spec section 3.5 pass-with-skip. Declared env for a live run: CI_HAS_CLOUDFLARE_ACCOUNT + CF_ACCOUNT_ID + CF_API_TOKEN (CF_API_BASE_URL optional test override).');
+  }
+  if (!process.env.CF_ACCOUNT_ID || !process.env.CF_API_TOKEN) {
     return {
       results: [{
-        anchorAcId: 'AC-5401-1',
-        verdict: 'pass',
-        detail: 'accountBoundSkipped: CI_HAS_CLOUDFLARE_ACCOUNT is not set to true; spec section 3.5 pass-with-skip.',
+        anchorAcId: 'AC-31103-1',
+        verdict: 'fail',
+        detail: `CI_HAS_CLOUDFLARE_ACCOUNT=true but one of CF_ACCOUNT_ID / CF_API_TOKEN is missing: accountIdPresent=${!!process.env.CF_ACCOUNT_ID} tokenPresent=${!!process.env.CF_API_TOKEN}.`,
       }],
-      extra: { accountBoundSkipped: true },
+      extra: {
+        envDeclared: Array.from(DECLARED_ENV),
+        throwawayPrefixes: { namespaceTitle: NAMESPACE_PREFIX, kvKey: KEY_PREFIX },
+      },
     };
   }
 
-  const accountId = process.env.CF_ACCOUNT_ID;
-  const namespaceId = process.env.CF_KV_NAMESPACE_ID;
-  const token = process.env.CF_API_TOKEN;
-  if (!accountId || !namespaceId || !token) {
+  const runId = process.env.GITHUB_RUN_ID || `local-${Date.now()}`;
+  let namespace = null;
+  const evidence = {
+    envDeclared: Array.from(DECLARED_ENV),
+    throwawayPrefixes: { namespaceTitle: NAMESPACE_PREFIX, kvKey: KEY_PREFIX },
+    runId,
+  };
+  try {
+    namespace = await mintScratchNamespace({ runId });
+    evidence.namespaceId = namespace.id;
+    evidence.namespaceTitle = namespace.title;
+  } catch (err) {
     return {
       results: [{
-        anchorAcId: 'AC-5401-1',
+        anchorAcId: 'AC-31103-1',
         verdict: 'fail',
-        detail: `CI_HAS_CLOUDFLARE_ACCOUNT=true but one of CF_ACCOUNT_ID/CF_KV_NAMESPACE_ID/CF_API_TOKEN is missing: accountIdPresent=${!!accountId} namespaceIdPresent=${!!namespaceId} tokenPresent=${!!token}`,
+        detail: `mintScratchNamespace failed: ${err.message}`,
       }],
+      extra: evidence,
     };
   }
 
-  const key = `platform-cloudflare-kv/real-account-smoke/${Date.now()}`;
+  const key = generateKey({ runId });
   const value = `smoke-${Math.random().toString(36).slice(2)}`;
-  const putUrl = `${API_BASE}/accounts/${accountId}/storage/kv/namespaces/${namespaceId}/values/${encodeURIComponent(key)}`;
-  const authHeaders = { authorization: `Bearer ${token}`, 'content-type': 'text/plain' };
+  evidence.key = key;
+  evidence.valueSample = value;
 
-  const putResp = await fetch(putUrl, { method: 'PUT', headers: authHeaders, body: value });
-  if (!putResp.ok) {
-    return {
-      results: [{
-        anchorAcId: 'AC-5401-1',
-        verdict: 'fail',
-        detail: `real-account smoke: PUT returned status ${putResp.status}`,
-      }],
-    };
-  }
+  try {
+    const put = await putScratchKey({ namespaceId: namespace.id, key, value });
+    evidence.putStatus = put.status;
 
-  const start = Date.now();
-  let observed = null;
-  while (Date.now() - start < CAP_MS) {
-    const getResp = await fetch(putUrl, { method: 'GET', headers: { authorization: `Bearer ${token}` } });
-    if (getResp.ok) {
-      const body = await getResp.text();
-      if (body === value) {
-        observed = body;
+    const start = Date.now();
+    let observed = null;
+    while (Date.now() - start < CAP_MS) {
+      const got = await getScratchKey({ namespaceId: namespace.id, key });
+      if (got.ok && got.text === value) {
+        observed = got.text;
+        evidence.getStatusOnHit = got.status;
         break;
       }
+      await new Promise((r) => setTimeout(r, POLL_INTERVAL_MS));
     }
-    await new Promise((r) => setTimeout(r, POLL_INTERVAL_MS));
-  }
+    const elapsed = Date.now() - start;
+    evidence.elapsedMs = elapsed;
+    evidence.capMs = CAP_MS;
 
-  const elapsed = Date.now() - start;
+    // Delete the scratch key regardless of outcome; the namespace
+    // destroy in the finally block would remove it anyway, but the
+    // per-key delete proves the delete verb on the shipped path.
+    try {
+      const del = await deleteScratchKey({ namespaceId: namespace.id, key });
+      evidence.deleteStatus = del.status;
+    } catch (err) {
+      evidence.deleteError = err.message;
+    }
 
-  // Clean up the written key regardless of outcome.
-  try {
-    await fetch(putUrl, { method: 'DELETE', headers: { authorization: `Bearer ${token}` } });
-  } catch (_err) {
-    // Best effort; do not fail the probe on cleanup.
+    const pass = observed === value;
+    return {
+      results: [{
+        anchorAcId: 'AC-31103-1',
+        verdict: pass ? 'pass' : 'fail',
+        detail: pass
+          ? `real-account KV eventual-consistency: mint namespace ${namespace.id} (${namespace.title}); PUT key ${key} (status ${evidence.putStatus}); write eventually appeared on same-region GET within elapsed=${elapsed}ms (CAP=${CAP_MS}ms); DELETE key (status ${evidence.deleteStatus ?? 'unset'}); namespace destroyed on teardown.`
+          : `real-account KV eventual-consistency: mint namespace ${namespace.id} (${namespace.title}); PUT key ${key} (status ${evidence.putStatus}); write did NOT appear within CAP=${CAP_MS}ms; elapsed=${elapsed}ms.`,
+      }],
+      extra: evidence,
+    };
+  } finally {
+    try {
+      const teardown = await destroyScratchNamespace(namespace);
+      evidence.namespaceDestroyed = teardown.destroyed;
+    } catch (err) {
+      evidence.teardownError = err.message;
+      process.stderr.write(`h2-cf-kv probe: teardown failed for namespace ${namespace && namespace.id}: ${err.message}; sweepOrphans will collect on next run.\n`);
+    }
   }
-
-  const pass = observed === value;
-  return {
-    results: [{
-      anchorAcId: 'AC-5401-1',
-      verdict: pass ? 'pass' : 'fail',
-      detail: pass
-        ? `write eventually appeared on the same-region read within elapsed=${elapsed}ms (CAP=${CAP_MS}ms)`
-        : `write did not appear within CAP=${CAP_MS}ms; elapsed=${elapsed}ms`,
-    }],
-    extra: { elapsedMs: elapsed, cap: CAP_MS },
-  };
 }

package/blueprints/platform-cloudflare-kv/docs/topics.md

@@ -46,7 +46,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
 | application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
 | persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
-| object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.1.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
 | platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |
@@ -55,6 +55,9 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
 | edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
 | edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
+| deploy-hetzner-server | 37101-37899 | 38xx | shipped v1.0.0 | `linuxCloudHostContract`, `snapshotAndBackupCadence` |
+| platform-docker-compose-host | 38101-38899 | 39xx | shipped v1.0.0 | `containerHostContract` |
+| edge-cloudflare-tunnel | 39101-39899 | 40xx | shipped v1.0.0 | `edgeIngressBridge` |
 
 US 31101-31108 sit at the LOW end of the 31101-31899 band on purpose (watchpost run-4 lesson). A project-side story mechanically derived from a platform-cloudflare-kv REQ id into the number 31110 would collide against a shipped US-31110; band headroom (31109-31899) leaves that space.
 

package/blueprints/platform-docker-compose-host/CHANGELOG.md

@@ -0,0 +1,12 @@
+# platform-docker-compose-host CHANGELOG
+
+## 1.0.0 - 2026-09-08
+
+Initial release. Round-7 T-2 of the Hetzner spec at `projects/blueprint-library/specs/hetzner-round-7-spec-2026-09-07.md`.
+
+- Mints capability `containerHost` and global topic `containerHostContract`.
+- Six REQs, nine USs, four TACs, four ADRs; five Node-only probes.
+- Extends the shared throwaway-Hetzner-server fixture with a minimal compose stack (`compose.yaml`, `caddy/Caddyfile`, `secrets/web-token` file mount, `src/serve.mjs` healthchecked stub) plus five `run-<probe>.mjs` delegate shims.
+- Compose-config-lint carries four mutation switches (`SIMULATE_MISSING_HEALTHCHECK`, `SIMULATE_UNCLASSIFIED_RESTART`, `SIMULATE_UNCLASSIFIED_LOG_DRIVER`, `SIMULATE_EVENT_SECRECY_LEAK`); secrets-as-files-scan carries `SIMULATE_PLAINTEXT_SECRET`; caddyfile-validate carries `SIMULATE_INVALID_CADDYFILE` and runs `caddy validate` via the `caddy:2` container when a local `caddy` binary is not on PATH.
+- Reverse-proxy choice elicited via `reverse-proxy` (caddy default per Baz decision 19; traefik and none alternatives); Coolify rejected verbatim per Baz decision 20; log driver elicited via `log-driver` (journald default; loki opt-in).
+- Consumers: `w-2026-09-07-dave-004` migrates the ops-01 remote-library compose stack onto this contract after 0.25.0 ships; blueprint acceptance never depends on that migration.