rcf-lite 0.24.0 → 0.26.0

package/blueprints/edge-cloudflare-tunnel/blueprint.json

@@ -0,0 +1,168 @@
+{
+  "slug": "edge-cloudflare-tunnel",
+  "version": "1.0.1",
+  "category": "edge",
+  "capabilities": [
+    "tunnelBridge"
+  ],
+  "suggestedCompanions": [
+    {
+      "role": "logging",
+      "reason": "Every cloudflaredReady, tunnelConnectorUp, tunnelConnectorDown, ingressRuleReloaded and accessGateRefused event writes through the applied logger; a logging companion supplies the factory."
+    },
+    {
+      "role": "errorHandling",
+      "reason": "A cloudflared exit, a JWT-check failure, an ingress-rule schema violation, a hostname-DNS-route API refusal constructs an internal error record; an error-handling companion supplies the record factory and the boundary."
+    }
+  ],
+  "elicits": [
+    {
+      "id": "tunnel-name",
+      "prompt": "The Cloudflare Tunnel name (also the manifest filename under cloudflare/tunnels/<name>.yaml). Names the connector in cloudflared tunnel list and in the routing DNS entries.",
+      "kind": "string",
+      "default": "probe"
+    },
+    {
+      "id": "cloudflare-zone-secret",
+      "prompt": "security-secrets-management reference to the Cloudflare zone the tunnel serves under. Read at apply time to create the DNS route; never inlined into the manifest.",
+      "kind": "string",
+      "default": "hq-estate/CLOUDFLARE_ZONE_ID"
+    },
+    {
+      "id": "public-hostname-template",
+      "prompt": "Template for the public hostname (e.g. <service>.<zone>). The template is expanded per ingress rule at apply time.",
+      "kind": "string",
+      "default": "<service>.<zone>"
+    },
+    {
+      "id": "ingress-rules",
+      "prompt": "Ingress rules array: each entry names a public hostname and the internal service URL to route to. The last entry is a mandatory catch-all http_status 404 (added by the blueprint if omitted).",
+      "kind": "string",
+      "default": "[]"
+    },
+    {
+      "id": "access-aud",
+      "prompt": "Optional Access AUD tag for the Access-gated shape. When present AND edge-cloudflare-access is applied (zeroTrustGate on appliedCapabilities), every ingress rule attaches originRequest.access.aud with this value. When absent OR edge-cloudflare-access is not applied, the block is omitted and the tunnel serves in public-hostname mode.",
+      "kind": "string",
+      "default": ""
+    },
+    {
+      "id": "connector-runtime",
+      "prompt": "Connector runtime per ADR-4002. compose-service is the shipped default when containerHost is applied (T-2 platform-docker-compose-host on top of T-1 deploy-hetzner-server); systemd-unit is the alternative for a bare cloudHost per the cloudflared as-a-service local-configuration-file docs.",
+      "kind": "enum",
+      "options": [
+        "compose-service",
+        "systemd-unit"
+      ],
+      "default": "compose-service"
+    }
+  ],
+  "contributions": [
+    {
+      "id": "edge-cloudflare-tunnel-REQ-001",
+      "kind": "req",
+      "path": "requirements/edge-cloudflare-tunnel-req-001.json"
+    },
+    {
+      "id": "edge-cloudflare-tunnel-REQ-002",
+      "kind": "req",
+      "path": "requirements/edge-cloudflare-tunnel-req-002.json"
+    },
+    {
+      "id": "edge-cloudflare-tunnel-REQ-003",
+      "kind": "req",
+      "path": "requirements/edge-cloudflare-tunnel-req-003.json"
+    },
+    {
+      "id": "edge-cloudflare-tunnel-REQ-004",
+      "kind": "req",
+      "path": "requirements/edge-cloudflare-tunnel-req-004.json"
+    },
+    {
+      "id": "edge-cloudflare-tunnel-REQ-005",
+      "kind": "req",
+      "path": "requirements/edge-cloudflare-tunnel-req-005.json"
+    },
+    {
+      "id": "edge-cloudflare-tunnel-US-39101",
+      "kind": "us",
+      "path": "user-stories/edge-cloudflare-tunnel-us-39101.json"
+    },
+    {
+      "id": "edge-cloudflare-tunnel-US-39102",
+      "kind": "us",
+      "path": "user-stories/edge-cloudflare-tunnel-us-39102.json"
+    },
+    {
+      "id": "edge-cloudflare-tunnel-US-39103",
+      "kind": "us",
+      "path": "user-stories/edge-cloudflare-tunnel-us-39103.json"
+    },
+    {
+      "id": "edge-cloudflare-tunnel-US-39104",
+      "kind": "us",
+      "path": "user-stories/edge-cloudflare-tunnel-us-39104.json"
+    },
+    {
+      "id": "edge-cloudflare-tunnel-US-39105",
+      "kind": "us",
+      "path": "user-stories/edge-cloudflare-tunnel-us-39105.json"
+    },
+    {
+      "id": "edge-cloudflare-tunnel-US-39106",
+      "kind": "us",
+      "path": "user-stories/edge-cloudflare-tunnel-us-39106.json"
+    },
+    {
+      "id": "edge-cloudflare-tunnel-US-39107",
+      "kind": "us",
+      "path": "user-stories/edge-cloudflare-tunnel-us-39107.json"
+    },
+    {
+      "id": "edge-cloudflare-tunnel-US-39108",
+      "kind": "us",
+      "path": "user-stories/edge-cloudflare-tunnel-us-39108.json"
+    },
+    {
+      "id": "TAC-4001-edge-cloudflare-tunnel-connector-shape",
+      "kind": "tac",
+      "path": "tacs/tac-4001-edge-cloudflare-tunnel-connector-shape.json"
+    },
+    {
+      "id": "TAC-4002-edge-cloudflare-tunnel-manifest-schema",
+      "kind": "tac",
+      "path": "tacs/tac-4002-edge-cloudflare-tunnel-manifest-schema.json"
+    },
+    {
+      "id": "TAC-4003-edge-cloudflare-tunnel-access-binding",
+      "kind": "tac",
+      "path": "tacs/tac-4003-edge-cloudflare-tunnel-access-binding.json"
+    },
+    {
+      "id": "ADR-4001-edge-cloudflare-tunnel-ingress-bridge-contract",
+      "kind": "adr",
+      "path": "adrs/adr-4001-edge-cloudflare-tunnel-ingress-bridge-contract.json",
+      "scope": "global",
+      "topic": "edgeIngressBridge",
+      "recommendedDefault": true,
+      "elicited": false,
+      "standardsTraceClause": "Cloudflare Tunnel overview and get-started documented mechanics per hetzner-round-7-spec-2026-09-07.md"
+    },
+    {
+      "id": "ADR-4002-edge-cloudflare-tunnel-connector-runtime",
+      "kind": "adr",
+      "path": "adrs/adr-4002-edge-cloudflare-tunnel-connector-runtime.json",
+      "recommendedDefault": true,
+      "elicited": true,
+      "standardsTraceClause": "Cloudflare cloudflared as-a-service documented systemd unit per hetzner-round-7-spec-2026-09-07.md"
+    },
+    {
+      "id": "ADR-4003-edge-cloudflare-tunnel-hostname-mode",
+      "kind": "adr",
+      "path": "adrs/adr-4003-edge-cloudflare-tunnel-hostname-mode.json",
+      "recommendedDefault": true,
+      "elicited": false,
+      "standardsTraceClause": "Cloudflare Access self-hosted-public-app documented shape per hetzner-round-7-spec-2026-09-07.md"
+    }
+  ]
+}

package/blueprints/edge-cloudflare-tunnel/contributions/adrs/adr-4001-edge-cloudflare-tunnel-ingress-bridge-contract.json

@@ -0,0 +1,23 @@
+{
+  "adrId": "ADR-4001-edge-cloudflare-tunnel-ingress-bridge-contract",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "accepted",
+  "title": "Edge ingress bridge contract: Cloudflare Tunnel as the shipped ingress-bridge shape from a cloudHost service to the CF edge (scope global, new topic edgeIngressBridge)",
+  "context": "An applying project running on a Linux cloudHost needs one shipped answer to the question of how a service on that host reaches the public internet without opening origin ports. Round-7 T-3 mints the edgeIngressBridge topic on this ADR. Cloudflare Tunnel is the shipped v1.0.0 mechanism (cloudflared connector out to the CF edge; DNS route on a Cloudflare zone; ingress rules mapping public hostname to internal service URL). Every applied ingress bridge needs one project-wide answer to the edgeIngressBridge topic; a future non-Cloudflare sibling (Tailscale Funnel, Fly.io proxy) would contribute the same topic string with a different mechanism, forcing a DELIBERATE conflict the operator resolves per the round-2 conflict pattern. Standards trace clause: Cloudflare Tunnel overview and get-started documented mechanics per hetzner-round-7-spec-2026-09-07.md.",
+  "decision": "The shipped v1.0.0 default is a Cloudflare Tunnel connector as the edgeIngressBridge provider. A cloudflared connector on the applying host (compose service by default when containerHost is applied per ADR-4002; systemd unit on a bare cloudHost) reads a tunnel manifest at cloudflare/tunnels/<name>.yaml and terminates ingress at the CF edge. The edgeIngressBridge topic scope is global on this blueprint; the topic string is edgeIngressBridge (lower camelCase, one concept per topic, no version suffix, per the round-2 rules-for-new-topics clause on the shelf registry). Standards trace clause: Cloudflare Tunnel overview and get-started documented mechanics per hetzner-round-7-spec-2026-09-07.md.",
+  "consequences": "Consumer blueprints that expose a service publicly declare capabilities: [tunnelBridge] on their applied contract to know a bridge is in place. Composition with zeroTrustGate (edge-cloudflare-access) toggles the Access-gated ingress shape per ADR-4003. A T-3-only project (no reverse proxy) declares no 80/443 firewall rule; the tunnel is the sole path from the edge to the origin. Rebuild-from-manifest is always possible: the manifest is the source of truth, the running connector is derivative. Folding this shape into edge-cloudflare-access was rejected: Access is an authorisation gate, Tunnel is an ingress bridge; the responsibilities are distinct and one applies without the other.",
+  "alternativesConsidered": [
+    {
+      "name": "Fold into edge-cloudflare-access as an adapter",
+      "reason": "Access is an authorisation gate on top of an ingress; Tunnel is an ingress bridge. One applies without the other. Folding conflated two decisions the operator ships separately. Rejected per Baz ruling decision 21."
+    },
+    {
+      "name": "Ship a Tailscale Funnel or Fly.io proxy sibling in the same PR",
+      "reason": "Out of scope for round 7. Siblings mint on operator demand into their own reserved slots and conflict-by-design with this blueprint on the edgeIngressBridge topic."
+    }
+  ],
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/edge-cloudflare-tunnel/contributions/adrs/adr-4002-edge-cloudflare-tunnel-connector-runtime.json

@@ -0,0 +1,19 @@
+{
+  "adrId": "ADR-4002-edge-cloudflare-tunnel-connector-runtime",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "accepted",
+  "title": "Connector runtime: compose-service default when containerHost applied; systemd-unit alternative on bare cloudHost",
+  "context": "The cloudflared connector runs in one of two supported vendor shapes: as a container image published on the cloudflared downloads page, or as a systemd unit installed via the vendor package per the cloudflared as-a-service local-configuration-file docs. An applying project running its stack under docker compose has a natural home for the connector alongside its other services (same network, same logging driver, same restart policy). An applying project running bare on the host has no compose stack and needs a systemd unit for boot ordering and journald logging. Standards trace clause: Cloudflare cloudflared as-a-service documented systemd unit per hetzner-round-7-spec-2026-09-07.md.",
+  "decision": "The connector runtime is elicited via connector-runtime with enum {compose-service, systemd-unit} and recommendedDefault compose-service. When the containerHost capability is applied (T-2 platform-docker-compose-host) the shipped default is compose-service; when the host runs bare (only T-1 applied) the operator picks systemd-unit at apply time. Standards trace clause: Cloudflare cloudflared as-a-service documented systemd unit per hetzner-round-7-spec-2026-09-07.md.",
+  "consequences": "The fixture ships both variants and both pass the local probes (manifest-schema-validate, cloudflared-config-lint, aud-presence-check). A future non-Cloudflare tunnel sibling (Tailscale Funnel, Fly.io proxy) reuses the runtime enum shape but the elicit lives on that sibling own ADR (conflict-by-design on edgeIngressBridge per ADR-4001). The systemd variant carries an install caveat in the guide: the vendor package landed via apt or curl per the as-a-service docs, which is out of scope for the blueprint itself.",
+  "alternativesConsidered": [
+    {
+      "name": "Ship only the compose-service variant",
+      "reason": "A bare cloudHost is a valid apply shape; forcing docker compose onto a host that does not want it is a hard cost the elicit avoids."
+    }
+  ],
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/edge-cloudflare-tunnel/contributions/adrs/adr-4003-edge-cloudflare-tunnel-hostname-mode.json

@@ -0,0 +1,19 @@
+{
+  "adrId": "ADR-4003-edge-cloudflare-tunnel-hostname-mode",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "accepted",
+  "title": "Hostname mode: access-gated when zeroTrustGate applied (ingress attaches AUD); public-hostname when absent (block omitted)",
+  "context": "A tunnel can serve a public hostname openly (any request reaches the origin, protected only by whatever authentication the origin itself carries) or Access-gated (cloudflared refuses at the edge any request without a valid Access JWT for a named AUD, per the vendor self-hosted-public-app docs). The hostname mode is not elicited: it is DISCOVERED from the applied capability set. When zeroTrustGate is applied (edge-cloudflare-access v1.0.0), the tunnel binds the Access AUD; when it is not, the tunnel serves in public-hostname mode. Standards trace clause: Cloudflare Access self-hosted-public-app documented shape per hetzner-round-7-spec-2026-09-07.md.",
+  "decision": "ADR-4003 records the hostname mode as elicited: false and discovered from applied capabilities via the sidecar rcf/blueprints/edge-cloudflare-tunnel.applied.json. When appliedCapabilities includes zeroTrustGate, every ingress rule under the tunnel manifest attaches an originRequest.access block naming the AUD; when it does not, the block is omitted. The aud-presence-check probe runs on both fixture variants and asserts the shape flips correctly. Standards trace clause: Cloudflare Access self-hosted-public-app documented shape per hetzner-round-7-spec-2026-09-07.md.",
+  "consequences": "A project that applies zeroTrustGate later inherits the Access-gated shape on the next reapply of edge-cloudflare-tunnel without a manual manifest edit; a project that removes zeroTrustGate drops to public-hostname mode explicitly. A silent drift (the sidecar keeps zeroTrustGate but the ingress loses the AUD block) is caught by aud-presence-check refusing before the shape ships. Fixture variants live under cloudflared/sidecars/{access-gated,public-hostname}.applied.json; the SIMULATE_AUD_DROP mutation on the gated fixture proves the refuse path.",
+  "alternativesConsidered": [
+    {
+      "name": "Elicit the hostname mode as a separate parameter",
+      "reason": "The applied capability set is already the source of truth; a separate elicit would drift from that set. Discovery keeps the shape aligned by construction."
+    }
+  ],
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/edge-cloudflare-tunnel/contributions/probes/aud-presence-check.mjs

@@ -0,0 +1,114 @@
+// Probe: aud-presence-check.
+//
+// anchorAcId list:
+// - AC-tunnel-accessGated (primary)
+// - AC-tunnel-accessGatedRefuse (drift refuse)
+// accountBound: false.
+//
+// The probe reads the two sidecars under fixtureRoot()/sidecars and the
+// two manifests per runtime under fixtureRoot()/<runtime>/cloudflare/tunnels/<mode>.yaml.
+// A fixture-side delegate points FIXTURE_ROOT at a scratch copy to drive
+// the fixture-side aud-drop mutation. The probe module itself is a pure
+// function of the files it sees.
+//
+// Passes when:
+// - Each access-gated manifest carries originRequest.access.aud equal to
+//   the gated sidecar accessAud on every non-catch-all ingress rule.
+// - Each public-hostname manifest carries no originRequest.access block.
+//
+// Fails when the gated variant drifts to omit the AUD block (the drift-
+// refuse case). Also fails when the public-hostname variant carries an
+// AUD block (that shape has no source of authority).
+
+import { readFile } from 'node:fs/promises';
+import { resolve } from 'node:path';
+import { runShim, fixtureRoot, parseTunnelYaml, RUNTIMES } from './probe-utils.mjs';
+
+export const anchorAcIds = ['AC-tunnel-accessGated', 'AC-tunnel-accessGatedRefuse'];
+export const accountBound = false;
+
+async function loadSidecar(root, name) {
+  const path = resolve(root, 'sidecars', `${name}.applied.json`);
+  const text = await readFile(path, 'utf8');
+  return JSON.parse(text);
+}
+
+async function loadManifest(root, runtime, mode) {
+  const path = resolve(root, runtime, 'cloudflare/tunnels', `${mode}.yaml`);
+  const text = await readFile(path, 'utf8');
+  return parseTunnelYaml(text);
+}
+
+export default async function runProbe() {
+  const results = [];
+  const extra = { fixtureRoot: fixtureRoot() };
+  const root = fixtureRoot();
+  const gatedSidecar = await loadSidecar(root, 'access-gated');
+  const publicSidecar = await loadSidecar(root, 'public-hostname');
+  const gatedHasZtg = (gatedSidecar.appliedCapabilities ?? []).includes('zeroTrustGate');
+  const publicHasZtg = (publicSidecar.appliedCapabilities ?? []).includes('zeroTrustGate');
+  extra.gatedSidecarZtg = gatedHasZtg;
+  extra.publicSidecarZtg = publicHasZtg;
+  if (!gatedHasZtg) {
+    results.push({
+      anchorAcId: 'AC-tunnel-accessGated',
+      verdict: 'fail',
+      detail: `access-gated sidecar is missing zeroTrustGate in appliedCapabilities (found: ${(gatedSidecar.appliedCapabilities ?? []).join(', ')})`,
+    });
+  }
+  if (publicHasZtg) {
+    results.push({
+      anchorAcId: 'AC-tunnel-accessGated',
+      verdict: 'fail',
+      detail: `public-hostname sidecar unexpectedly names zeroTrustGate in appliedCapabilities (found: ${(publicSidecar.appliedCapabilities ?? []).join(', ')})`,
+    });
+  }
+  for (const runtime of RUNTIMES) {
+    // access-gated manifest: every non-catch-all rule attaches the AUD.
+    const gDoc = await loadManifest(root, runtime, 'access-gated');
+    const gRules = Array.isArray(gDoc.ingress) ? gDoc.ingress : [];
+    const gNonCatch = gRules.filter((r) => !String(r.service ?? '').startsWith('http_status:'));
+    const gAttached = gNonCatch.filter((r) => r?.originRequest?.access?.aud === gatedSidecar.accessAud);
+    if (gAttached.length === gNonCatch.length && gNonCatch.length > 0) {
+      results.push({
+        anchorAcId: 'AC-tunnel-accessGated',
+        verdict: 'pass',
+        detail: `${runtime}/access-gated: all ${gNonCatch.length} non-catch-all rule(s) attach originRequest.access.aud=${gatedSidecar.accessAud}`,
+      });
+    } else {
+      const missing = gNonCatch
+        .filter((r) => r?.originRequest?.access?.aud !== gatedSidecar.accessAud)
+        .map((r, i) => `service=${r.service} aud=${r?.originRequest?.access?.aud ?? '(none)'}`);
+      results.push({
+        anchorAcId: 'AC-tunnel-accessGatedRefuse',
+        verdict: 'fail',
+        detail: `${runtime}/access-gated: sidecar declares zeroTrustGate + accessAud=${gatedSidecar.accessAud} but ${gNonCatch.length - gAttached.length}/${gNonCatch.length} rule(s) drift (missing or wrong AUD). Drifted: ${missing.slice(0, 3).join(' | ')}`,
+      });
+    }
+    // public-hostname manifest: no rule carries originRequest.access.
+    const pDoc = await loadManifest(root, runtime, 'public-hostname');
+    const pRules = Array.isArray(pDoc.ingress) ? pDoc.ingress : [];
+    const carriers = pRules
+      .map((r, i) => ({ i, r }))
+      .filter(({ r }) => r?.originRequest?.access);
+    if (carriers.length === 0) {
+      results.push({
+        anchorAcId: 'AC-tunnel-accessGated',
+        verdict: 'pass',
+        detail: `${runtime}/public-hostname: manifest omits originRequest.access on every ingress rule (open ingress by design)`,
+      });
+    } else {
+      results.push({
+        anchorAcId: 'AC-tunnel-accessGated',
+        verdict: 'fail',
+        detail: `${runtime}/public-hostname: sidecar declares no zeroTrustGate but ${carriers.length} ingress rule(s) carry originRequest.access; that shape has no source of authority`,
+      });
+    }
+  }
+  return { results, extra };
+}
+
+const engine = { kind: 'sidecar-read', image: 'edge-cloudflare-tunnel aud-presence facade', healthy: true };
+if (import.meta.url === `file://${process.argv[1]}`) {
+  await runShim('aud-presence-check', engine, runProbe);
+}

package/blueprints/edge-cloudflare-tunnel/contributions/probes/cloudflared-config-lint.mjs

@@ -0,0 +1,80 @@
+// Probe: cloudflared-config-lint.
+//
+// anchorAcId list: AC-tunnel-hostnameRoutes (primary).
+// accountBound: false.
+//
+// Verdict is a pure function of the files at fixtureRoot(). The probe:
+// 1. Locates cloudflared (local binary on PATH first, else the vendor
+//    container image cloudflare/cloudflared:2026.8.3 via docker run --rm).
+// 2. Runs `cloudflared tunnel ingress validate --config /etc/cloudflared/<mode>.yaml`
+//    against each fixture (compose-service and systemd-unit, both public-
+//    hostname and access-gated modes); asserts exit 0 on the canonical fixture.
+// 3. When neither cloudflared nor docker is available, records warn (the
+//    schema-validate probe still surfaces the source-tree shape).
+
+import { spawnSync } from 'node:child_process';
+import { resolve } from 'node:path';
+import {
+  runShim, fixtureRoot, pairs, whichDocker, whichCloudflared, CLOUDFLARED_IMAGE,
+} from './probe-utils.mjs';
+
+export const anchorAcIds = ['AC-tunnel-hostnameRoutes'];
+export const accountBound = false;
+
+function runCloudflaredLint({ manifestDir, manifestName, useDocker, cloudflaredVersion }) {
+  if (!useDocker) {
+    const r = spawnSync('cloudflared', ['tunnel', '--config', resolve(manifestDir, manifestName), 'ingress', 'validate'], {
+      encoding: 'utf8', timeout: 60_000,
+    });
+    return { status: r.status, stdout: r.stdout ?? '', stderr: r.stderr ?? '', engine: `cloudflared ${cloudflaredVersion}` };
+  }
+  const r = spawnSync('docker', [
+    'run', '--rm', '-v', `${manifestDir}:/etc/cloudflared:ro`,
+    CLOUDFLARED_IMAGE, 'tunnel', '--config', `/etc/cloudflared/${manifestName}`, 'ingress', 'validate',
+  ], { encoding: 'utf8', timeout: 120_000 });
+  return { status: r.status, stdout: r.stdout ?? '', stderr: r.stderr ?? '', engine: `docker ${CLOUDFLARED_IMAGE}` };
+}
+
+export default async function runProbe() {
+  const results = [];
+  const extra = { fixtureRoot: fixtureRoot() };
+  const cloudflared = whichCloudflared();
+  const docker = whichDocker();
+  extra.cloudflaredVersion = cloudflared;
+  extra.dockerVersion = docker;
+  if (!cloudflared && !docker) {
+    results.push({
+      anchorAcId: 'AC-tunnel-hostnameRoutes',
+      verdict: 'warn',
+      detail: 'Neither a local cloudflared binary nor docker is available on PATH; cloudflared tunnel ingress validate was not exercised. Install cloudflared or docker to exercise the lint.',
+    });
+    return { results, extra };
+  }
+  const useDocker = !cloudflared;
+  for (const { runtime, mode } of pairs()) {
+    const manifestDir = resolve(fixtureRoot(), runtime, 'cloudflare/tunnels');
+    const manifestName = `${mode}.yaml`;
+    const r = runCloudflaredLint({ manifestDir, manifestName, useDocker, cloudflaredVersion: cloudflared });
+    if (r.status === 0) {
+      results.push({
+        anchorAcId: 'AC-tunnel-hostnameRoutes',
+        verdict: 'pass',
+        detail: `${runtime}/${mode}: cloudflared tunnel ingress validate exit 0 (${r.engine})`,
+      });
+    } else {
+      const tail = (r.stderr || r.stdout || '').split('\n').slice(-8).join(' | ').slice(0, 800);
+      results.push({
+        anchorAcId: 'AC-tunnel-hostnameRoutes',
+        verdict: 'fail',
+        detail: `${runtime}/${mode}: cloudflared tunnel ingress validate exit ${r.status} (${r.engine}): ${tail}`,
+      });
+    }
+    extra[`${runtime}/${mode}`] = { exit: r.status };
+  }
+  return { results, extra };
+}
+
+const engine = { kind: 'cloudflared-ingress-validate', image: CLOUDFLARED_IMAGE, healthy: true };
+if (import.meta.url === `file://${process.argv[1]}`) {
+  await runShim('cloudflared-config-lint', engine, runProbe);
+}