rcf-lite 0.24.0 → 0.26.0

package/rcf/user-stories/us-13001.json

@@ -0,0 +1,23 @@
+{
+  "createdAt": "2026-09-08T03:21:16.415Z",
+  "updatedAt": "2026-09-08T03:21:16.415Z",
+  "usId": "US-13001",
+  "prdId": "PRD-001",
+  "reqId": "REQ-130",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-3 cloudflared connector install shape switches on applied containerHost (compose-service default; systemd-unit fallback for bare cloudHost)",
+  "asA": "shelf consumer applying edge-cloudflare-tunnel v1.0.0 alongside deploy-hetzner-server (and optionally platform-docker-compose-host)",
+  "iWant": "the cloudflared connector to install as a compose service when the containerHost capability is applied and as a systemd unit when the host runs bare",
+  "soThat": "the runtime shape matches the applied platform rather than forcing a container onto a bare host or a bare service into a compose-managed stack",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-13001-1",
+      "description": "The blueprint declares its connector runtime via ADR-4002 with elicited enum {compose-service, systemd-unit} and recommendedDefault compose-service. The shared fixture ships both variants under packages/rcf-lite/test/fixtures/hetzner-throwaway-server/cloudflared/{compose-service,systemd-unit}/; the compose-service variant defines a cloudflared service alongside the T-2 web and caddy services on the same web-net network with restart unless-stopped, no host ports and a healthcheck; the systemd-unit variant ships a cloudflared.service unit file per the vendor local-configuration-file docs.",
+      "testable": true
+    }
+  ],
+  "tacIds": [
+    "TAC-4001-edge-cloudflare-tunnel-connector-shape"
+  ]
+}

package/rcf/user-stories/us-13002.json

@@ -0,0 +1,23 @@
+{
+  "createdAt": "2026-09-08T03:21:16.655Z",
+  "updatedAt": "2026-09-08T03:21:16.655Z",
+  "usId": "US-13002",
+  "prdId": "PRD-001",
+  "reqId": "REQ-130",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-3 cloudflared connector reports healthy on boot (tunnelConnectorUp fires with connector id, region, version)",
+  "asA": "shelf consumer applying edge-cloudflare-tunnel v1.0.0 on a cloudHost",
+  "iWant": "the connector to emit a tunnelConnectorUp event on boot with connector id, region and version metadata (metadata only)",
+  "soThat": "the observability sink proves the tunnel is up without a shell into the host",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-13002-1",
+      "description": "real-account-connector-healthy probe declares accountBound true (on CI_HAS_CLOUDFLARE_ACCOUNT AND CI_HAS_HETZNER_ACCOUNT) and records accountBoundSkipped when either env var is unset. When both are set the probe drives cloudflared tunnel info against the fixture tunnel and asserts at least one healthy connector plus a tunnelConnectorUp event with connector id, region and version.",
+      "testable": true
+    }
+  ],
+  "tacIds": [
+    "TAC-4001-edge-cloudflare-tunnel-connector-shape"
+  ]
+}

package/rcf/user-stories/us-13101.json

@@ -0,0 +1,23 @@
+{
+  "createdAt": "2026-09-08T03:21:16.885Z",
+  "updatedAt": "2026-09-08T03:21:16.885Z",
+  "usId": "US-13101",
+  "prdId": "PRD-001",
+  "reqId": "REQ-131",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-3 tunnel manifest schema at cloudflare/tunnels/<name>.yaml validates on shape (tunnel id, credentials secretRef, ingress rules with catch-all 404)",
+  "asA": "shelf consumer applying edge-cloudflare-tunnel v1.0.0",
+  "iWant": "the tunnel manifest at cloudflare/tunnels/<name>.yaml to validate against a shipped JSON schema (uuid-shaped tunnel id, secretRef credentials, ingress rules with a mandatory catch-all http_status 404)",
+  "soThat": "a mis-shaped manifest is caught at apply-time rather than at first inbound request",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-13101-1",
+      "description": "manifest-schema-validate probe passes on the canonical fixture at cloudflared/*/cloudflare/tunnels/probe.yaml and fails when the fixture is mutated: SIMULATE_MANIFEST_INVALID_TUNNEL_ID rewrites the tunnel-id field to a non-uuid literal; SIMULATE_MANIFEST_CREDENTIALS_INLINE writes the credentials JSON body inline (bypassing the secretRef); SIMULATE_MANIFEST_MISSING_CATCHALL removes the catch-all rule. Each mutation FAILS naming the offending field.",
+      "testable": true
+    }
+  ],
+  "tacIds": [
+    "TAC-4002-edge-cloudflare-tunnel-manifest-schema"
+  ]
+}

package/rcf/user-stories/us-13102.json

@@ -0,0 +1,23 @@
+{
+  "createdAt": "2026-09-08T03:21:17.114Z",
+  "updatedAt": "2026-09-08T03:21:17.114Z",
+  "usId": "US-13102",
+  "prdId": "PRD-001",
+  "reqId": "REQ-131",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-3 ingress rules route the public hostname to an internal service URL and cloudflared config lint exits 0",
+  "asA": "shelf consumer applying edge-cloudflare-tunnel v1.0.0 with a compose service listening on an internal port",
+  "iWant": "the ingress rule mapping the public hostname to the internal service URL (e.g. http://web:8080) to pass cloudflared tunnel ingress validate cleanly",
+  "soThat": "a rule that would fail at boot fails at gate instead",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-13102-1",
+      "description": "cloudflared-config-lint probe runs cloudflared tunnel ingress validate through the cloudflare/cloudflared container image (when the binary is not on PATH) against the fixture manifest and exits 0 on the canonical fixture; SIMULATE_INGRESS_INVALID rewrites the ingress rule service URL to an unresolvable scheme and the probe FAILS naming the offending line.",
+      "testable": true
+    }
+  ],
+  "tacIds": [
+    "TAC-4002-edge-cloudflare-tunnel-manifest-schema"
+  ]
+}

package/rcf/user-stories/us-13201.json

@@ -0,0 +1,23 @@
+{
+  "createdAt": "2026-09-08T03:21:17.345Z",
+  "updatedAt": "2026-09-08T03:21:17.345Z",
+  "usId": "US-13201",
+  "prdId": "PRD-001",
+  "reqId": "REQ-132",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-3 no public origin ports on the host (firewall stays 22 plus 80/443-only-when-reverse-proxy; manifest refuses an origin-port request)",
+  "asA": "shelf consumer applying edge-cloudflare-tunnel v1.0.0 without a reverse proxy",
+  "iWant": "the host firewall to stay closed on 80/443 and the manifest schema to refuse any ingress rule that binds to a host public port rather than an internal address",
+  "soThat": "the tunnel remains the only path from the edge to the origin",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-13201-1",
+      "description": "manifest-schema-validate refuses ingress rules whose service URL binds to a host public interface. SIMULATE_ORIGIN_PORT_OPEN rewrites the ingress rule service URL to http://0.0.0.0:80 (or a host-relative port); the probe FAILS naming the leak. The T-1 firewall on the ci-throwaway manifest stays 22 open plus 80/443 open only when a reverse proxy is applied; a T-3-only project declares no 80/443 rule.",
+      "testable": true
+    }
+  ],
+  "tacIds": [
+    "TAC-4002-edge-cloudflare-tunnel-manifest-schema"
+  ]
+}

package/rcf/user-stories/us-13301.json

@@ -0,0 +1,23 @@
+{
+  "createdAt": "2026-09-08T03:21:17.575Z",
+  "updatedAt": "2026-09-08T03:21:17.575Z",
+  "usId": "US-13301",
+  "prdId": "PRD-001",
+  "reqId": "REQ-133",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-3 Access-gated composition: when zeroTrustGate is applied, ingress rules attach originRequest.access.aud",
+  "asA": "shelf consumer applying edge-cloudflare-tunnel v1.0.0 alongside edge-cloudflare-access v1.0.0",
+  "iWant": "every ingress rule to attach an originRequest.access block naming the Access AUD",
+  "soThat": "cloudflared refuses at the edge any request that arrives without a valid Access JWT for that AUD",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-13301-1",
+      "description": "aud-presence-check probe passes on BOTH fixture variants: on the access-gated variant every ingress rule attaches originRequest.access.aud read from the sidecar rcf/blueprints/edge-cloudflare-tunnel.applied.json (appliedCapabilities includes zeroTrustGate); on the public-hostname variant the originRequest.access block is absent from every rule (appliedCapabilities excludes zeroTrustGate). The shape flip is a pure function of the sidecar contents.",
+      "testable": true
+    }
+  ],
+  "tacIds": [
+    "TAC-4003-edge-cloudflare-tunnel-access-binding"
+  ]
+}

package/rcf/user-stories/us-13302.json

@@ -0,0 +1,23 @@
+{
+  "createdAt": "2026-09-08T03:21:17.805Z",
+  "updatedAt": "2026-09-08T03:21:17.805Z",
+  "usId": "US-13302",
+  "prdId": "PRD-001",
+  "reqId": "REQ-133",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-3 shape does not silently degrade to open ingress when zeroTrustGate drifts absent on a project that intended the gated shape (aud-presence-check refuses)",
+  "asA": "shelf consumer who applied edge-cloudflare-tunnel v1.0.0 with zeroTrustGate on",
+  "iWant": "a probe that asserts the ingress rule keeps its originRequest.access.aud block on every reapply and refuses if the block drifts absent",
+  "soThat": "a silent config drift to open ingress is caught at gate rather than at first probing",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-13302-1",
+      "description": "aud-presence-check refuses when the gated variant drifts to open ingress. SIMULATE_AUD_DROP rewrites the gated fixture ingress to remove the originRequest.access block; the probe FAILS with a defensive-against-silent-degradation finding naming the affected rule and the missing AUD value.",
+      "testable": true
+    }
+  ],
+  "tacIds": [
+    "TAC-4003-edge-cloudflare-tunnel-access-binding"
+  ]
+}

package/rcf/user-stories/us-13401.json

@@ -0,0 +1,23 @@
+{
+  "createdAt": "2026-09-08T03:21:18.038Z",
+  "updatedAt": "2026-09-08T03:21:18.038Z",
+  "usId": "US-13401",
+  "prdId": "PRD-001",
+  "reqId": "REQ-134",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-3 credentials-file discipline (JSON at mode 0o400, referenced via secretRef, not committed, grep-refuses on the literal, no leak in event bodies)",
+  "asA": "shelf consumer applying edge-cloudflare-tunnel v1.0.0 on a cloudHost",
+  "iWant": "the tunnel credentials file to land at mode 0o400 on the host, be referenced from the manifest as a secretRef, never be committed to the applying project tree (grep-refuse on the tunnel id and account tag literals), and never appear in any lifecycle event body",
+  "soThat": "a leaked credentials file cannot happen through a review-time miss",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-13401-1",
+      "description": "The fixture credentials placeholder at cloudflared/credentials/probe.json.example carries a note that a real credentials file must land at mode 0o400 on the host; the manifest references it via a secretRef; the grep-refuse pattern is documented in the guide; every cloudflaredReady, tunnelConnectorUp and ingressRuleReloaded event body captured by the in-process facade carries metadata only, and SIMULATE_EVENT_SECRECY_LEAK inserts the credentials literal into a lifecycle event body and the scan FAILS naming the leaked field.",
+      "testable": true
+    }
+  ],
+  "tacIds": [
+    "TAC-4002-edge-cloudflare-tunnel-manifest-schema"
+  ]
+}

package/rcf/user-stories/us-14001.json

@@ -0,0 +1,21 @@
+{
+  "createdAt": "2026-09-08T09:02:48.558Z",
+  "updatedAt": "2026-09-08T09:05:33.736Z",
+  "description": "As a shelf consumer applying object-storage-s3 v1.1.0 on a Hetzner Object Storage bucket, I want an endpoint-shape helper that composes the vendor-documented endpoint pattern from an elicited bucket and location code, and a probe that proves the composed endpoint round-trips a byte-equal put/get/delete on either a real Hetzner Object Storage bucket (when CI_HAS_HETZNER_OBJECT_STORAGE is set) or records accountBoundSkipped true when not, so the R2 real-account smoke and the MinIO local-emulator flow both stay unaffected while the shelf gains a fourth provider value alongside R2, AWS, MinIO. Chain: HQ round-7 follow-up adapter block per HQ chain-block ruling 2026-09-08.",
+  "usId": "US-14001",
+  "prdId": "PRD-001",
+  "reqId": "REQ-140",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-follow-up adapter object-storage-s3 v1.1.0 Hetzner: endpoint-shape helper composes <bucket>.<location>.your-objectstorage.com; new probe hetzner-object-storage-round-trip drives put/get/delete against the composed endpoint on the extended fixture; accountBound gated on CI_HAS_HETZNER_OBJECT_STORAGE",
+  "asA": "shelf consumer applying object-storage-s3 v1.1.0 on a Hetzner Object Storage bucket (fsn1, hel1 or nbg1 location)",
+  "iWant": "an endpoint-shape helper that composes <bucket>.<location>.your-objectstorage.com from an elicited bucket and location per the Hetzner storage overview, plus a new Node-only probe hetzner-object-storage-round-trip.mjs driven from the extended infra-s3-and-queue fixture that either round-trips a byte-equal put/get/delete against a real Hetzner Object Storage bucket when CI_HAS_HETZNER_OBJECT_STORAGE is set or records accountBoundSkipped true when unset",
+  "soThat": "the shelf gains a fourth provider value alongside R2, AWS and MinIO with no runtime dependency added to the applying project, no facade re-shape, and no regression to the shipped MinIO local-emulator or R2 real-account paths",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-14001-1",
+      "description": "Given the extended fixture packages/rcf-lite/test/fixtures/infra-s3-and-queue/ carrying hetzner-endpoint.mjs and run-hetzner-object-storage-round-trip.mjs, when node blueprints/object-storage-s3/contributions/probes/run-hetzner-object-storage-round-trip.mjs runs, then either (a) with CI_HAS_HETZNER_OBJECT_STORAGE set alongside HETZNER_OBJECT_STORAGE_ACCESS_KEY_ID, HETZNER_OBJECT_STORAGE_SECRET_ACCESS_KEY, HETZNER_OBJECT_STORAGE_BUCKET and HETZNER_OBJECT_STORAGE_LOCATION the composed endpoint is https://<bucket>.<location>.your-objectstorage.com per the Hetzner storage overview and put/get/delete round-trips a byte-equal 1 KiB payload with teardown scrubbing the object; or (b) without CI_HAS_HETZNER_OBJECT_STORAGE the probe records accountBoundSkipped true and the aggregate flips to pass per spec section 3.5. The endpoint-shape helper is the sole composer of the vendor pattern; SIMULATE_HETZNER_ENDPOINT_MISSHAPEN true composes an invalid endpoint via the fixture-side shim (INPUT-side mutation) and the probe FAILS naming the missing subdomain. Anchors the label AC-hetznerObjectStorage-endpointRoundTrip on the blueprint side.",
+      "testable": true
+    }
+  ]
+}

package/rcf/user-stories/us-14501.json

@@ -0,0 +1,24 @@
+{
+  "createdAt": "2026-09-08T10:51:08.784Z",
+  "updatedAt": "2026-09-08T10:53:03.294Z",
+  "asA": "shelf consumer running the deploy-hetzner-server v1.0.1 real-account probes against a live Hetzner Cloud project (CI_HAS_HETZNER_ACCOUNT=true)",
+  "iWant": "the T-1 real-account probes to return aggregateVerdict pass without local patches: provision reads snake_case hcloud fields; the fixture renders the cloud-init user-data to a scratch path from the shipped template with resolved ssh public-key material and NOPASSWD sudo for the deploy user; provision, mock and destroy consume that same rendered file; destroy and sweep-orphans never pass --output json to a delete verb; the snapshot verb uses hcloud server create-image --type snapshot and matches by label; ssh baseline waits for cloud-init before firing; and the manifest ssh-key name is overridable via RCF_LITE_CI_SSH_KEY_NAME with the manifest value as default",
+  "soThat": "the mocked probes cannot pass while the real path fails on the same rendered artefact, throwaway servers never leak because destroy always succeeds, and the six baseline hardening blocks are observably present on the running server",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-14501-1",
+      "description": "Given the shared throwaway-server fixture at packages/rcf-lite/test/fixtures/hetzner-throwaway-server/ on the H-1 patch train, when node blueprints/deploy-hetzner-server/contributions/probes/run-real-account-throwaway-server-provision.mjs, run-real-account-cloud-init-hardened.mjs and run-real-account-snapshot-on-demand.mjs run against a live Hetzner Cloud project (CI_HAS_HETZNER_ACCOUNT=true, RCF_LITE_CI_SSH_KEY_NAME=dave-ed25519, HCLOUD_TOKEN from hq-estate/HETZNER_ACCOUNT_API_KEY), then (a) provision writes hetzner/servers/rendered/ci-throwaway.cloud-init.yaml by rendering the shipped cloud-init template with the ssh public-key material fetched via hcloud ssh-key describe --output json and a write_files sudoers.d fragment granting NOPASSWD to the deploy user; (b) provision reads s.public_net.ipv4.ip, s.datacenter.location.name, s.server_type.name (snake_case) off the hcloud server create --output json response and writes scratch/last-throwaway.json before returning; (c) hcloud-dry-run-mock.mjs reads the same rendered file back and asserts it carries at least one ssh-ed25519 or ssh-rsa line and a NOPASSWD directive naming the deploy user; (d) destroy.mjs and sweep-orphans.mjs never pass --output json to a hcloud <resource> delete verb and the tolerant JSON parser accepts arrays; (e) snapshot-verb.mjs shells hcloud server create-image --type snapshot --description <label> <id> and recovers the created id via hcloud image list --type=snapshot --output json by matching the serverName label; (f) ssh-baseline-check.mjs polls port 22 open plus a ssh true exec (bounded up to 6 minutes) before firing the six baseline checks, all six of which pass on the running server (sshKeyOnly, rootDisabled, ufwDefaultDeny, dockerUserChain, fail2banActive, unattendedUpgradesActive). Anchors the label AC-hetznerServer-realAccountFidelity.",
+      "testable": true
+    }
+  ],
+  "usId": "US-14501",
+  "prdId": "PRD-001",
+  "reqId": "REQ-145",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "H-1: deploy-hetzner-server 1.0.1 real-account probes return aggregateVerdict pass unpatched; fixture renders cloud-init with ssh public key material and NOPASSWD deploy user; mock consumes the same rendered file; destroy and sweep drop --output json on delete; snapshot uses hcloud server create-image --type snapshot; ssh baseline polls before firing; sshKeyIds override via RCF_LITE_CI_SSH_KEY_NAME",
+  "tacIds": [
+    "TAC-3801-deploy-hetzner-server-provisioner",
+    "TAC-3803-deploy-hetzner-server-cloud-init-template"
+  ]
+}

package/rcf/user-stories/us-15001.json

@@ -0,0 +1,26 @@
+{
+  "createdAt": "2026-09-08T12:17:33.807Z",
+  "updatedAt": "2026-09-08T12:19:24.742Z",
+  "asA": "rcf-lite maintainer applying platform-cloudflare-kv v1.0.0",
+  "iWant": "every kv probe result and the kv README to cite ACs from the shipped AC-31xxx band, and every one of the nine shipped kv ACs to appear as an anchor (primary or additional result) on at least one probe with a runtime observable",
+  "soThat": "the shipped kv probes count as evidence for the shipped kv ACs, no defunct AC-5xxx id survives on the kv blueprint, and traceability closes over the whole shipped kv surface",
+  "description": "As part of H-2 (Cloudflare-platform probe integrity), re-anchor every kv probe (facade-round-trip, list-with-prefix, cache-aside-hit-then-miss, event-secrecy, real-account-eventual-consistency-smoke), plus the kv README chain-slice pointers and the kv-anatomy test assertions, from AC-5xxx to the shipped AC-31xxx band per Dave ruling 4 (relay 582c2bca, 2026-09-08). The two ACs no shipped probe currently covers are added as additional results: AC-31102-1 (env.CACHE grep returns exactly src/kv-facade.mjs) becomes a runtime grep observable on facade-round-trip; AC-31107-1 (whitelist-only lifecycle events) becomes a whitelist-scan result on event-secrecy. Anatomy-test edits ride H-2 per dispatch addendum ruling 1. Nine ACs bound: 31101-1, 31102-1, 31103-1, 31103-2, 31104-1, 31105-1, 31106-1, 31107-1, 31108-1.",
+  "usId": "US-15001",
+  "prdId": "PRD-001",
+  "reqId": "REQ-150",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "H-2 kv re-anchor: every kv probe result cites AC-31xxx; every shipped kv AC gains a runtime observable through the existing five probes",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-15001-1",
+      "description": "A grep for AC-5 across blueprints/platform-cloudflare-kv/ (probes, README, changelog, guide, blueprint.json, .rcf/reports/blueprints/platform-cloudflare-kv/) returns zero hits. Every anchorAcId string in the five contributed kv probes (facade-round-trip, list-with-prefix, cache-aside-hit-then-miss, event-secrecy, real-account-eventual-consistency-smoke) and every AC id in the kv-anatomy test cite the shipped AC-31xxx band. The kv README chain-slice pointer paragraph names the shipped US-31101..US-31108 range and no AC-5xxx string remains.",
+      "testable": true
+    },
+    {
+      "id": "AC-15001-2",
+      "description": "Each of the nine shipped kv ACs (AC-31101-1, AC-31102-1, AC-31103-1, AC-31103-2, AC-31104-1, AC-31105-1, AC-31106-1, AC-31107-1, AC-31108-1) appears as an anchorAcId (primary or additional result) on at least one shipped kv probe result. AC-31102-1 is covered by a runtime env.CACHE-grep observable on facade-round-trip; AC-31107-1 is covered by a whitelist-scan observable on event-secrecy. A test in the kv-anatomy suite asserts each of the nine AC ids appears in the union of shipped probe results and each cited result is pass.",
+      "testable": true
+    }
+  ]
+}

package/rcf/user-stories/us-15101.json

@@ -0,0 +1,26 @@
+{
+  "createdAt": "2026-09-08T12:17:34.305Z",
+  "updatedAt": "2026-09-08T12:19:47.426Z",
+  "asA": "rcf-lite maintainer applying platform-cloudflare-durable-objects v1.0.0",
+  "iWant": "real-account-storage-smoke to drive a real HTTP round trip against a deployed Worker route that opens the DO facade, writes a fixture key and reads it back byte-equal (or record accountBoundSkipped when the account env is absent), and the five DO ACs currently unbound (AC-33106-1, AC-33108-1, AC-33109-1, AC-33110-1, AC-33111-1) to appear as additional-result anchors on the wrangler-seam, storage-round-trip and concurrent-increment probes",
+  "soThat": "the real-account run proves the DO facade actually round-trips a value on Cloudflare (not just that credentials are present), and all 13 shipped DO ACs are bound to a probe with a runtime observable",
+  "description": "Part of H-2. The credential-readiness pass-stub is replaced by a real driver: when CI_HAS_CLOUDFLARE_ACCOUNT is set with CF_ACCOUNT_ID, CF_DO_NAMESPACE_ID (or the binding config the driver needs) and CF_API_TOKEN, the probe drives an HTTP round trip against a deployed Worker route; the returned bytes must equal the written bytes for pass. Local proof via the existing wrangler-seam against miniflare or wrangler dev. Env-absent branch keeps section 3.5 pass-with-skip shape. A pass must never again be reachable from credential presence alone. The five unbound ACs are bound as additional-result anchors on existing probes; if any AC has no honest carrier a new probe body is added inside existing capability.",
+  "usId": "US-15101",
+  "prdId": "PRD-001",
+  "reqId": "REQ-151",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "H-2 DO real storage driver + anchor coverage: real-account-storage-smoke drives a byte-equal put/get round-trip against a deployed Worker; five previously-unbound DO ACs bound as additional-result anchors on existing probes",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-15101-1",
+      "description": "When CI_HAS_CLOUDFLARE_ACCOUNT is set with CF_ACCOUNT_ID, CF_DO_NAMESPACE_ID (or the DO binding config the driver needs) and CF_API_TOKEN, real-account-storage-smoke drives an HTTP round trip against a deployed Worker route that opens the DO facade, writes a fixture key with a random 1 KiB payload, reads it back, and asserts the returned bytes equal the written value (fail-with-detail otherwise, never pass on credential-presence). Local proof: the same driver path against miniflare or wrangler dev via the existing wrangler-seam. Env-absent branch keeps section 3.5 pass-with-skip. A mutation switch (moved to a fixture-side shim; not read from a probe body) that returns wrong bytes on read causes aggregateVerdict fail with the observed vs expected bytes named.",
+      "testable": true
+    },
+    {
+      "id": "AC-15101-2",
+      "description": "Each of the thirteen shipped DO ACs (AC-33101-1..AC-33113-1) appears as an anchorAcId (primary or additional result) on at least one shipped DO probe result. The five previously-unbound DO ACs (AC-33106-1, AC-33108-1, AC-33109-1, AC-33110-1, AC-33111-1) are bound as additional-result anchors on the wrangler-seam, storage-round-trip and concurrent-increment probes where the probe genuinely observes the AC's behaviour; a new probe body is added inside existing capability only if no existing probe carries the observable. A test in the DO anatomy suite asserts each of the thirteen AC ids appears in the union of shipped probe results and each cited result is pass.",
+      "testable": true
+    }
+  ]
+}

package/rcf/user-stories/us-15201.json

@@ -0,0 +1,21 @@
+{
+  "createdAt": "2026-09-08T12:17:34.801Z",
+  "updatedAt": "2026-09-08T12:19:47.822Z",
+  "asA": "rcf-lite maintainer applying messaging-queue-cloudflare v1.0.0",
+  "iWant": "real-account-concurrency-smoke to publish 500 messages through the producer facade wired to a live Queues binding on a deployed Worker and assert concurrent processing up to the documented push-invocation cap when CI_HAS_CLOUDFLARE_ACCOUNT is set (or record accountBoundSkipped when it is not)",
+  "soThat": "the real-account run proves the queue actually processes messages concurrently on Cloudflare (not just that credentials are present) and the accountBoundSkipped pass-stub can never again be reached from account-flag presence alone",
+  "description": "Part of H-2. Cloudflare Queues does not support wrangler dev --remote, so the real-account driver rides a deployed Worker that binds the queue (queue name and binding parameterised via env; HQ supplies values at gate time, canonical queue rcf-lite-ci-queue-smoke per HQ runbook). The account-set branch publishes 500 messages, waits for delivery under a bounded timeout, and asserts concurrent processing per the documented push-invocation cap. Local proof against miniflare or wrangler dev (local queue simulation). The env-absent branch keeps pass-with-skip. The documented Cloudflare Queues limits URL (https://developers.cloudflare.com/queues/platform/limits/) is re-verified 200 at merge time and logged in the PR provenance transcript.",
+  "usId": "US-15201",
+  "prdId": "PRD-001",
+  "reqId": "REQ-152",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "H-2 queue real concurrency driver: real-account-concurrency-smoke publishes 500 messages through the producer facade against a live Queues binding on a deployed Worker and asserts concurrent processing up to the documented push-invocation cap",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-15201-1",
+      "description": "When CI_HAS_CLOUDFLARE_ACCOUNT is set with the deployed-Worker binding env vars, real-account-concurrency-smoke publishes 500 messages through the producer facade wired to a live Queues binding on the deployed Worker (queue name and binding parameterised via env, canonical queue rcf-lite-ci-queue-smoke), waits under a bounded timeout for all 500 to be observed on the consumer side, and asserts concurrent processing occurred (observed max-in-flight consumers greater than one, up to and not exceeding the documented push-invocation cap read from Cloudflare Queues limits). accountBoundSkipped is never set on the account-set branch; a pass is unreachable from account-flag presence alone. Local proof: the same driver path against miniflare or wrangler dev with local queue simulation. Env-absent branch keeps section 3.5 pass-with-skip. The documented limits URL https://developers.cloudflare.com/queues/platform/limits/ is fetched once at merge time, must answer 200 and is logged in the PR provenance transcript.",
+      "testable": true
+    }
+  ]
+}

package/rcf/user-stories/us-15301.json

@@ -0,0 +1,31 @@
+{
+  "createdAt": "2026-09-08T12:17:35.296Z",
+  "updatedAt": "2026-09-08T12:19:48.200Z",
+  "asA": "rcf-lite maintainer applying edge-cloudflare-tunnel v1.0.0",
+  "iWant": "real-account-connector-healthy to actually provision the throwaway hetzner server through the T-1 fixture surface and run cloudflared tunnel info <name> asserting healthy connector count (when both CI_HAS_CLOUDFLARE_ACCOUNT and CI_HAS_HETZNER_ACCOUNT are set), real-account-tunnel-hostname-routes to drive undici for the public-hostname sub-case (activated on CI_HAS_CLOUDFLARE_ACCOUNT) and a two-identity JWT probe for the access-gated sub-case (activated only when CI_HAS_CLOUDFLARE_ACCESS is also set), and manifest-schema-validate to fail with a fixture-setup pointer when the credentials placeholder is missing rather than warn",
+  "soThat": "the real-account tunnel run proves connectors are up and routes actually serve on Cloudflare, the warn-on-env-set branches never again mask a broken driver, and a missing fixture pointer surfaces as a clear failure not a warning",
+  "description": "Part of H-2. connector-healthy consumes the hetzner fixture as-is; its defects are H-1 scope at HQ; if the fixture path fails locally the driver fails with a pointer naming the fixture step, never warn. hostname-routes: the public-hostname sub-case fetches the scratch subdomain via undici; the access-gated sub-case obtains an Access Service Token identity, exchanges it for a JWT and asserts an authenticated fetch succeeds AND an unauthenticated fetch is denied; the AUD sub-case stays pass-with-skip when CI_HAS_CLOUDFLARE_ACCESS is unset (HQ note: Access is not enabled on the HQ account today, so at gate time the AUD sub-case stays pass-with-skip until HQ enables Access, expected not a driver defect). Env-absent branch keeps pass-with-skip on both probes; a pass must never again be reachable from account-flag presence alone.",
+  "usId": "US-15301",
+  "prdId": "PRD-001",
+  "reqId": "REQ-153",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "H-2 tunnel real drivers: connector-healthy exercises cloudflared tunnel info against the throwaway hetzner server; hostname-routes drives undici and (when Access is enabled) a two-identity JWT probe; manifest-schema-validate placeholder becomes fail-with-pointer",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-15301-1",
+      "description": "When both CI_HAS_CLOUDFLARE_ACCOUNT and CI_HAS_HETZNER_ACCOUNT are set with the required credentials, real-account-connector-healthy provisions the throwaway hetzner server via the T-1 hetzner fixture surface, brings a named cloudflared tunnel connector up on it, runs cloudflared tunnel info <name> through a cloudflared control shim, asserts the reported healthy connector count is at least one, captures a tunnelConnectorUp event on the injected event sink, and tears the connector and server down on exit. If the hetzner fixture path fails locally the driver fails with a pointer naming the failed fixture step (hetzner fixture defects are H-1 scope at HQ, never a warn on this driver). Env-absent branch keeps section 3.5 pass-with-skip.",
+      "testable": true
+    },
+    {
+      "id": "AC-15301-2",
+      "description": "When CI_HAS_CLOUDFLARE_ACCOUNT is set with the required tunnel credentials, real-account-tunnel-hostname-routes drives an undici fetch against the configured scratch subdomain for the public-hostname sub-case, asserts an HTTP 200 with expected body signature. When CI_HAS_CLOUDFLARE_ACCESS is ALSO set with Access service-token identities, the same probe drives a two-identity JWT sub-case: identity A obtains a JWT via the Service Token exchange and an authenticated fetch to the access-gated hostname succeeds; identity B without a JWT is denied (HTTP 302 to Access or HTTP 401). accountBoundSkipped is never set on the account-set branch; a pass is unreachable from CI_HAS_CLOUDFLARE_ACCOUNT presence alone on this probe. The access-gated sub-case remains pass-with-skip when CI_HAS_CLOUDFLARE_ACCESS is unset (HQ note: not enabled on HQ account today, expected). Env-absent branch keeps pass-with-skip.",
+      "testable": true
+    },
+    {
+      "id": "AC-15301-3",
+      "description": "manifest-schema-validate.mjs returns aggregateVerdict fail (not warn) with a detail string naming the missing credentials placeholder file and the fixture-setup step that would create it when the credentials placeholder is absent. The warn-on-missing-credentials-placeholder branch is removed.",
+      "testable": true
+    }
+  ]
+}

package/rcf/user-stories/us-15401.json

@@ -0,0 +1,31 @@
+{
+  "createdAt": "2026-09-08T12:17:35.792Z",
+  "updatedAt": "2026-09-08T12:19:48.599Z",
+  "asA": "rcf-lite maintainer applying the four Cloudflare-platform blueprints",
+  "iWant": "no SIMULATE_ read anywhere in a shipped probe body on the four blueprints, no fail envelope committed under .rcf/reports on the four blueprints, and every committed envelope reflecting a shipped-code pass run against the re-anchored probes",
+  "soThat": "the mutation-purity rule holds at the probe boundary, envelopes are trusted evidence rather than stale fail records, and honest labelling of local test doubles restores probe-comment credibility",
+  "description": "Part of H-2. All SIMULATE_ branches in shipped probe bodies (kv cache-aside-hit-then-miss, kv event-secrecy, DO sole-reader-scan, DO storage-round-trip, DO websocket-hub-broadcast) move to fixture-side shim modules under packages/rcf-lite/test/fixtures/cf-platform/ or .../cf-edge/. New shim files carry the h2-cf-platform-probe-integrity slug prefix (short form h2-cf acceptable). Every driver's negative path is proven by firing the fixture-side mutation switch and observing the FAIL tail; only shipped-code pass envelopes are committed. The committed fail envelope at .rcf/reports/blueprints/platform-cloudflare-kv/event-secrecy.json is deleted and a shipped-code pass envelope committed in its place; the other four kv envelopes are regenerated so committed envelopes reflect re-anchored shipped-code runs. Probe comments labelling doubles as fake state / fake WebSocket pair / fake clock are reworded to name the local double honestly, or adjudicated acceptable with reason in the PR body.",
+  "usId": "US-15401",
+  "prdId": "PRD-001",
+  "reqId": "REQ-154",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "H-2 cross-cutting probe hygiene: SIMULATE_ branches out of probe bodies into fixture shims; no fail envelope committed; probe comments name test doubles honestly",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-15401-1",
+      "description": "A grep for the token SIMULATE_ across every shipped probe module (contributions/probes/*.mjs) on the four Cloudflare-platform blueprints (platform-cloudflare-kv, platform-cloudflare-durable-objects, messaging-queue-cloudflare, edge-cloudflare-tunnel) returns zero hits. Every mutation switch previously read from a probe body is now read from a fixture-side shim module under packages/rcf-lite/test/fixtures/cf-platform/ or .../cf-edge/ whose file name carries the h2-cf-platform-probe-integrity slug prefix (short form h2-cf acceptable). For each moved switch, a corresponding FAIL tail is observed and recorded in the PR provenance transcript when the shims switch is on.",
+      "testable": true
+    },
+    {
+      "id": "AC-15401-2",
+      "description": "No committed report under .rcf/reports/blueprints/{platform-cloudflare-kv, platform-cloudflare-durable-objects, messaging-queue-cloudflare, edge-cloudflare-tunnel}/ carries aggregateVerdict fail or warn. Every committed envelope on the four blueprints reflects a shipped-code pass run against the re-anchored probes; the previously committed fail envelope at .rcf/reports/blueprints/platform-cloudflare-kv/event-secrecy.json is replaced with a shipped-code pass envelope.",
+      "testable": true
+    },
+    {
+      "id": "AC-15401-3",
+      "description": "Every probe-comment or probe-utils-comment surfaced by stage-1 marker rows (kv fake clock; DO fake state; DO probe-utils lines 73 and 75; DO websocket-hub-broadcast fake WebSocket pair; kv not-yet elicit-gating wording) is either reworded to name the local test double honestly on its terms (a fixture in-memory driver realises the Workers KV binding shape; a synthetic WebSocket pair; an elicited fake wall-clock advanced deterministically by the fixture; a follow-up work-item note in place of not-yet) or adjudicated acceptable in the PR body with a stated reason. No shipped probe comment on the four blueprints carries a bare fake / not-yet marker without either honest naming or an adjudication row.",
+      "testable": true
+    }
+  ]
+}

package/releases/releases.yaml

@@ -40,8 +40,28 @@
 # `npm install rcf-lite`.
 
 feedVersion: 1
-latest: "0.24.0"
+latest: "0.26.0"
 releases:
+  - version: "0.26.0"
+    date: "2026-09-09"
+    breaking: false
+    headlines:
+      - "rcf-lite 0.26.0 is a hardening and authoring release. The Cloudflare-platform blueprints on the shelf pick up real-account probe drivers with positive evidence and one shared account-token env matrix."
+      - "The blueprint authoring standard gains three new sections (7c REQ-layer sufficiency, 7d positive-evidence verification, 7e single-definition ownership), ten checklist rows and RULE 16 in the managed agent block."
+      - "The rcf define blueprint verb group gains a lint-consistency subverb, a per-slug disposition ledger with an apply-time prompt and a read-only dispositions view, and the identity seed grows a register field. The schema floor moves to rcf-schemas 0.6.2."
+    minAgentAction: null
+    notesUrl: "https://stravica.ai/docs/rcf/changelog/"
+
+  - version: "0.25.0"
+    date: "2026-09-08"
+    breaking: false
+    headlines:
+      - "rcf-lite 0.25.0 opens the Hetzner line with three blueprints in one round: a Hetzner Cloud server as the shipped Linux VM shape with the estate hardening baseline and a snapshot cadence, a docker-compose platform on top with healthchecks, secrets as file mounts and a first-class reverse-proxy artefact, and a Cloudflare Tunnel bridge that composes with Access when Zero Trust is applied and drops to public-hostname mode when it is not."
+      - "Every real-account probe across the round ships accountBoundSkipped pending the Hetzner and Cloudflare token vault ruling; the local probes carry the ship-time verdicts."
+      - "The follow-up Hetzner Object Storage adapter ships as a sequential PR under object-storage-s3 v1.1.0 after this release; the rcf-lite package version does not bump for it."
+    minAgentAction: null
+    notesUrl: "https://stravica.ai/docs/rcf/changelog/"
+
   - version: "0.24.0"
     date: "2026-09-08"
     breaking: false

package/src/blueprint/apply.js

@@ -21,6 +21,7 @@ import { updateManifest } from './manifest-writer.js';
 import { stampId } from './namespace.js';
 import { nextResolutionId } from './resolutions.js';
 import { buildRefusalMessage, discoverAppliedCapabilities, runCustomAuthCapabilityElicits, runElicitationPhase, writeSidecar } from './capabilities.js';
+import { APPLY_DISPOSITION_PROMPT, initialiseLedger } from './disposition-ledger.js';
 
 /**
  * @typedef {object} ApplyResult
@@ -410,11 +411,36 @@ export async function applyBlueprint({ projectRoot, tree, source, displaySource,
     });
   }
 
+  // Disposition ledger. On a fresh apply, initialise
+  // rcf/blueprints/<slug>.disposition.json with one record per
+  // contributed AC so the applying agent has a machine-readable walk
+  // list. Reads AC ids and their `disposition` field (rcf-schemas
+  // 0.6.2) from the SOURCE user-story JSON so the record reflects the
+  // authored shape, not the stamped one; `fixed` ACs land as accepted
+  // with the sentinel reason, `template` and unmarked ACs land as
+  // pending-disposition. Re-apply leaves an existing ledger untouched.
+  let ledgerPath = null;
+  let dispositionPrompt = null;
+  let acCount = 0;
+  if (!dryRun) {
+    const acDescriptors = await collectAcDescriptorsFromSource(source, blueprint, namespace);
+    acCount = acDescriptors.length;
+    if (acCount > 0) {
+      const ledgerRes = await initialiseLedger({ projectRoot, slug: appliedSlug, acDescriptors, now });
+      ledgerPath = ledgerRes.path;
+      if (!ledgerRes.alreadyExisted) {
+        dispositionPrompt = APPLY_DISPOSITION_PROMPT(appliedSlug, blueprint.version, acCount);
+      }
+    }
+  }
+
   return {
     applied: true,
     slug: appliedSlug,
     version: blueprint.version,
     contributions: writtenContributions,
+    ...(ledgerPath ? { ledgerPath, dispositionAcCount: acCount } : {}),
+    ...(dispositionPrompt ? { dispositionPrompt } : {}),
     ...(wroteSidecar ? { sidecarPath, appliedCapabilities, appliedElicitations } : {}),
     // Companion-suggestion mechanism (spec 2.6). Bubble the source
     // blueprint's `suggestedCompanions[]` up on the result so the CLI
@@ -428,6 +454,44 @@ export async function applyBlueprint({ projectRoot, tree, source, displaySource,
   };
 }
 
+/**
+ * Walk the blueprint's user-story contributions on-disk and collect
+ * every AC as a { id, storyId, sourceDisposition? } descriptor for the
+ * disposition ledger. AC ids and story ids are stamped with the
+ * applied namespace so they match what the applying agent sees in the
+ * tree (rather than the raw blueprint-slug ids on the source files).
+ *
+ * `disposition` on the AC (rcf-schemas 0.6.2 $defs.acDisposition) is
+ * `fixed` | `template` and is optional; an unmarked AC lands as
+ * pending-disposition with no `sourceDisposition` field so the operator
+ * can decide.
+ */
+async function collectAcDescriptorsFromSource(sourcePath, blueprint, namespace) {
+  const descriptors = [];
+  for (const c of blueprint.contributions ?? []) {
+    if (c.kind !== 'us' || typeof c.path !== 'string') continue;
+    const abs = join(sourcePath, 'contributions', c.path);
+    let doc;
+    try { doc = JSON.parse(await readFile(abs, 'utf8')); } catch { continue; }
+    const rawStoryId = typeof doc.usId === 'string' ? doc.usId : c.id;
+    // Re-stamp under the applied namespace so a library-qualified apply
+    // (namespace differs from the blueprint's own slug) records the
+    // story id the applying agent will actually see on the tree.
+    const storyStamped = stampId(rawStoryId, namespace);
+    const storyId = 'error' in storyStamped ? rawStoryId : storyStamped.id;
+    const acs = Array.isArray(doc.acceptanceCriteria) ? doc.acceptanceCriteria : [];
+    for (const ac of acs) {
+      if (!ac || typeof ac.id !== 'string') continue;
+      const descriptor = { id: ac.id, storyId };
+      if (ac.disposition === 'fixed' || ac.disposition === 'template') {
+        descriptor.sourceDisposition = ac.disposition;
+      }
+      descriptors.push(descriptor);
+    }
+  }
+  return descriptors;
+}
+
 function stampContributions(contributions, namespace) {
   const out = [];
   for (const c of contributions ?? []) {