rcf-lite 0.24.0 → 0.26.0

package/blueprints/edge-cloudflare-tunnel/contributions/probes/real-account-tunnel-hostname-routes.mjs

@@ -0,0 +1,166 @@
+// Probe: real-account-tunnel-hostname-routes.
+//
+// anchorAcId list (unchanged per H-2 C4 ruling; the AC-tunnel-* ids
+// ARE the shipped AC ids in the US-39104 / US-39106 contribution
+// bodies):
+// - AC-tunnel-hostnameRoutes (public-hostname sub-case: ingress rule
+//   routes public hostname to internal service URL and returns 200).
+// - AC-tunnel-accessGated (access-gated sub-case: Access-gated
+//   composition; unauthenticated request refused, JWT-carrying
+//   request accepted; per US-39106).
+//
+// accountBound: true.
+// Gating (amendment 4 verbatim):
+// - Public-hostname sub-case activated on CI_HAS_CLOUDFLARE_ACCOUNT
+//   AND CI_HAS_HETZNER_ACCOUNT.
+// - Access-gated sub-case activated only when CI_HAS_CLOUDFLARE_ACCESS
+//   is ALSO set. Env-absent branch keeps pass-with-skip; a pass must
+//   never be reachable from CI_HAS_CLOUDFLARE_ACCOUNT presence alone.
+// - HQ note: Cloudflare Access is not enabled on the HQ account, so
+//   at gate time the AUD sub-case stays pass-with-skip; expected,
+//   not a driver defect.
+//
+// Env-present, sub-case active: undici-based fetch driver against the
+// scratch subdomain via the cf-edge shim (production path uses Node's
+// built-in fetch; shim-synthetic path lets local runs exercise the
+// driver body without account access). For the access-gated
+// sub-case: send an unauthenticated request (must be refused with
+// 4xx) AND a JWT-carrying request (must be accepted with 2xx). A
+// pass requires BOTH results.
+
+import { runShim, accountBoundSkippedResult } from './probe-utils.mjs';
+
+export const anchorAcIds = ['AC-tunnel-hostnameRoutes', 'AC-tunnel-accessGated'];
+export const accountBound = true;
+
+const PUBLIC_URL_ENV = 'CF_TUNNEL_PUBLIC_URL';
+const ACCESS_URL_ENV = 'CF_TUNNEL_ACCESS_URL';
+const ACCESS_AUDIENCE_ENV = 'CF_ACCESS_AUDIENCE';
+const ACCESS_TEAM_SECRET_ENV = 'CF_ACCESS_TEAM_SECRET';
+const DEFAULT_PUBLIC_URL = 'https://h2-cf-public.scratch.example.invalid/health';
+const DEFAULT_ACCESS_URL = 'https://h2-cf-gated.scratch.example.invalid/protected';
+
+export default async function runProbe() {
+  const results = [];
+  const extra = {
+    envRequired: {
+      publicHostname: ['CI_HAS_CLOUDFLARE_ACCOUNT', 'CI_HAS_HETZNER_ACCOUNT'],
+      accessGated: ['CI_HAS_CLOUDFLARE_ACCOUNT', 'CI_HAS_HETZNER_ACCOUNT', 'CI_HAS_CLOUDFLARE_ACCESS'],
+    },
+    envPresent: {
+      CI_HAS_CLOUDFLARE_ACCOUNT: process.env.CI_HAS_CLOUDFLARE_ACCOUNT === 'true',
+      CI_HAS_HETZNER_ACCOUNT: process.env.CI_HAS_HETZNER_ACCOUNT === 'true',
+      CI_HAS_CLOUDFLARE_ACCESS: process.env.CI_HAS_CLOUDFLARE_ACCESS === 'true',
+    },
+  };
+  const hasPublic = extra.envPresent.CI_HAS_CLOUDFLARE_ACCOUNT && extra.envPresent.CI_HAS_HETZNER_ACCOUNT;
+  const hasGated = hasPublic && extra.envPresent.CI_HAS_CLOUDFLARE_ACCESS;
+
+  if (!hasPublic) {
+    results.push(accountBoundSkippedResult(
+      'AC-tunnel-hostnameRoutes',
+      ['CI_HAS_CLOUDFLARE_ACCOUNT', 'CI_HAS_HETZNER_ACCOUNT'],
+      'public-hostname sub-case: undici fetch against the scratch subdomain not exercised. Set CI_HAS_CLOUDFLARE_ACCOUNT=true AND CI_HAS_HETZNER_ACCOUNT=true to run this path.',
+    ));
+  }
+  if (!hasGated) {
+    results.push(accountBoundSkippedResult(
+      'AC-tunnel-accessGated',
+      ['CI_HAS_CLOUDFLARE_ACCOUNT', 'CI_HAS_HETZNER_ACCOUNT', 'CI_HAS_CLOUDFLARE_ACCESS'],
+      'access-gated sub-case: two-identity JWT check against the scratch subdomain not exercised. Requires all three env vars; a pass here is unreachable from CI_HAS_CLOUDFLARE_ACCOUNT presence alone (amendment 4 verbatim).',
+    ));
+  }
+  if (!hasPublic && !hasGated) {
+    return { results, extra };
+  }
+
+  // Sub-case active: load the shim seams.
+  const { fetchTunnelHostname, mintScratchIdentity } = await import(
+    '../../../../packages/rcf-lite/test/fixtures/cf-edge/h2-cf-tunnel-shim.mjs'
+  );
+
+  if (hasPublic) {
+    const url = process.env[PUBLIC_URL_ENV] || DEFAULT_PUBLIC_URL;
+    extra.publicHostnameUrl = url;
+    try {
+      const resp = await fetchTunnelHostname(url, { method: 'GET' });
+      extra.publicHostnameResponse = { status: resp.status, shimMode: resp.shimMode, bodyLength: resp.textBody.length };
+      if (resp.status >= 200 && resp.status < 300) {
+        results.push({
+          anchorAcId: 'AC-tunnel-hostnameRoutes',
+          verdict: 'pass',
+          detail: `public-hostname sub-case: fetch(${url}) returned ${resp.status} (shim mode ${resp.shimMode}), body length ${resp.textBody.length}. Ingress rule routes the public hostname to the internal service URL.`,
+        });
+      } else {
+        results.push({
+          anchorAcId: 'AC-tunnel-hostnameRoutes',
+          verdict: 'fail',
+          detail: `public-hostname sub-case: fetch(${url}) returned ${resp.status} (shim mode ${resp.shimMode}). Expected 2xx; the ingress rule did not route the public hostname to a healthy internal service.`,
+        });
+      }
+    } catch (err) {
+      results.push({
+        anchorAcId: 'AC-tunnel-hostnameRoutes',
+        verdict: 'fail',
+        detail: `public-hostname sub-case: fetch(${url}) threw: ${err.message}. Check the scratch subdomain, the tunnel manifest ingress rules, or the cf-edge shim.`,
+      });
+    }
+  }
+
+  if (hasGated) {
+    const url = process.env[ACCESS_URL_ENV] || DEFAULT_ACCESS_URL;
+    const audience = process.env[ACCESS_AUDIENCE_ENV] || 'h2-cf-scratch-audience';
+    const secret = process.env[ACCESS_TEAM_SECRET_ENV] || 'h2-cf-scratch-team-secret';
+    extra.accessGatedUrl = url;
+    let refusalResp;
+    let acceptResp;
+    try {
+      refusalResp = await fetchTunnelHostname(url, { method: 'GET' });
+    } catch (err) {
+      results.push({
+        anchorAcId: 'AC-tunnel-accessGated',
+        verdict: 'fail',
+        detail: `access-gated sub-case: unauthenticated fetch(${url}) threw: ${err.message}.`,
+      });
+      return { results, extra };
+    }
+    try {
+      const jwt = mintScratchIdentity({ audience, subject: 'h2-cf-scratch-identity', secret });
+      acceptResp = await fetchTunnelHostname(url, {
+        method: 'GET',
+        headers: { authorization: `Bearer ${jwt}` },
+      });
+    } catch (err) {
+      results.push({
+        anchorAcId: 'AC-tunnel-accessGated',
+        verdict: 'fail',
+        detail: `access-gated sub-case: JWT-carrying fetch(${url}) threw: ${err.message}.`,
+      });
+      return { results, extra };
+    }
+    extra.accessGatedRefusal = { status: refusalResp.status, shimMode: refusalResp.shimMode };
+    extra.accessGatedAccept = { status: acceptResp.status, shimMode: acceptResp.shimMode };
+    const refused = refusalResp.status >= 400 && refusalResp.status < 500;
+    const accepted = acceptResp.status >= 200 && acceptResp.status < 300;
+    if (refused && accepted) {
+      results.push({
+        anchorAcId: 'AC-tunnel-accessGated',
+        verdict: 'pass',
+        detail: `access-gated sub-case: unauthenticated request refused with ${refusalResp.status} and JWT-carrying request accepted with ${acceptResp.status} (shim mode ${refusalResp.shimMode}). Access gate composed correctly.`,
+      });
+    } else {
+      results.push({
+        anchorAcId: 'AC-tunnel-accessGated',
+        verdict: 'fail',
+        detail: `access-gated sub-case: expected 4xx-then-2xx; observed refusal status ${refusalResp.status} and JWT-accept status ${acceptResp.status} (shim mode ${refusalResp.shimMode}). Gate is drifted: unauthenticated request should be refused and JWT request accepted.`,
+      });
+    }
+  }
+
+  return { results, extra };
+}
+
+const engine = { kind: 'real-account-tunnel-fetch', image: 'undici fetch + cf-edge shim (scratch subdomain)', healthy: true };
+if (import.meta.url === `file://${process.argv[1]}`) {
+  await runShim('real-account-tunnel-hostname-routes', engine, runProbe);
+}

package/blueprints/edge-cloudflare-tunnel/contributions/probes/run-aud-presence-check.mjs

@@ -0,0 +1,4 @@
+import runProbe from './aud-presence-check.mjs';
+import { runShim } from './probe-utils.mjs';
+const engine = { kind: 'sidecar-read', image: 'edge-cloudflare-tunnel aud-presence facade', healthy: true };
+runShim('aud-presence-check', engine, runProbe);

package/blueprints/edge-cloudflare-tunnel/contributions/probes/run-cloudflared-config-lint.mjs

@@ -0,0 +1,4 @@
+import runProbe from './cloudflared-config-lint.mjs';
+import { runShim, CLOUDFLARED_IMAGE } from './probe-utils.mjs';
+const engine = { kind: 'cloudflared-ingress-validate', image: CLOUDFLARED_IMAGE, healthy: true };
+runShim('cloudflared-config-lint', engine, runProbe);

package/blueprints/edge-cloudflare-tunnel/contributions/probes/run-manifest-schema-validate.mjs

@@ -0,0 +1,4 @@
+import runProbe from './manifest-schema-validate.mjs';
+import { runShim } from './probe-utils.mjs';
+const engine = { kind: 'schema-validate', image: 'edge-cloudflare-tunnel manifest schema (Ajv-free walker)', healthy: true };
+runShim('manifest-schema-validate', engine, runProbe);

package/blueprints/edge-cloudflare-tunnel/contributions/probes/run-real-account-connector-healthy.mjs

@@ -0,0 +1,4 @@
+import runProbe from './real-account-connector-healthy.mjs';
+import { runShim } from './probe-utils.mjs';
+const engine = { kind: 'real-account-connector-healthy', image: 'account-bound', healthy: true };
+runShim('real-account-connector-healthy', engine, runProbe);

package/blueprints/edge-cloudflare-tunnel/contributions/probes/run-real-account-tunnel-hostname-routes.mjs

@@ -0,0 +1,4 @@
+import runProbe from './real-account-tunnel-hostname-routes.mjs';
+import { runShim } from './probe-utils.mjs';
+const engine = { kind: 'real-account-tunnel-hostname-routes', image: 'account-bound', healthy: true };
+runShim('real-account-tunnel-hostname-routes', engine, runProbe);

package/blueprints/edge-cloudflare-tunnel/contributions/probes/tunnel-manifest.schema.json

@@ -0,0 +1,55 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://stravica.ai/schemas/edge-cloudflare-tunnel/tunnel-manifest.v1.json",
+  "title": "edge-cloudflare-tunnel tunnel manifest v1.0.0",
+  "type": "object",
+  "required": ["tunnel", "credentialsFile", "ingress"],
+  "additionalProperties": false,
+  "properties": {
+    "tunnel": {
+      "type": "string",
+      "pattern": "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$",
+      "description": "uuid-shaped Cloudflare Tunnel id per the vendor tunnel primitive"
+    },
+    "credentialsFile": {
+      "type": "object",
+      "required": ["secretRef"],
+      "additionalProperties": false,
+      "properties": {
+        "secretRef": {
+          "type": "string",
+          "minLength": 1,
+          "description": "security-secrets-management reference to the credentials JSON; never a literal path or JSON body"
+        }
+      }
+    },
+    "ingress": {
+      "type": "array",
+      "minItems": 1,
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "properties": {
+          "hostname": { "type": "string", "minLength": 1 },
+          "service": { "type": "string", "minLength": 1 },
+          "originRequest": {
+            "type": "object",
+            "additionalProperties": true,
+            "properties": {
+              "access": {
+                "type": "object",
+                "required": ["aud"],
+                "properties": {
+                  "aud": { "type": "string", "minLength": 1 },
+                  "teamName": { "type": "string" },
+                  "required": { "type": "boolean" }
+                }
+              }
+            }
+          }
+        },
+        "required": ["service"]
+      }
+    }
+  }
+}

package/blueprints/edge-cloudflare-tunnel/contributions/requirements/edge-cloudflare-tunnel-req-001.json

@@ -0,0 +1,18 @@
+{
+  "reqId": "edge-cloudflare-tunnel-REQ-001",
+  "prdId": "PRD-001",
+  "title": "Connector install shape switches on applied containerHost (compose-service default; systemd-unit for bare cloudHost); cloudflaredReady fires on boot",
+  "description": "The blueprint contributes a cloudflared connector whose runtime shape is elicited via ADR-4002 with enum {compose-service, systemd-unit} and recommendedDefault compose-service. When containerHost is applied (T-2 platform-docker-compose-host on top of T-1 deploy-hetzner-server) the connector ships as a compose service alongside the applying project services on the same web-net network. When the host runs bare (only T-1 applied) the connector ships as a systemd unit per the vendor local-configuration-file docs. Either shape emits cloudflaredReady on boot with connector id, region and version metadata (metadata only; no token or credentials in the payload).",
+  "category": "functional",
+  "domain": "edge",
+  "priority": "must",
+  "rationale": "Ratified in the Hetzner round 7 spec (2026-09-07 section 5.3 edge-cloudflare-tunnel-REQ-001). Ships as v1.0.0 of edge-cloudflare-tunnel.",
+  "tags": [
+    "blueprint:edge-cloudflare-tunnel",
+    "capability:tunnelBridge"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/edge-cloudflare-tunnel/contributions/requirements/edge-cloudflare-tunnel-req-002.json

@@ -0,0 +1,18 @@
+{
+  "reqId": "edge-cloudflare-tunnel-REQ-002",
+  "prdId": "PRD-001",
+  "title": "Tunnel manifest schema at cloudflare/tunnels/<name>.yaml under the applying project (uuid tunnel id, secretRef credentials, ingress rules with catch-all 404)",
+  "description": "The applying project ships one tunnel manifest per named tunnel at cloudflare/tunnels/<name>.yaml. The shipped JSON schema requires a uuid-shaped tunnel id, a credentials-file reference into security-secrets-management (secretRef, never a literal path or JSON body inline), and an ingress rules array whose last entry is a mandatory catch-all rule returning http_status 404. cloudflared refuses to boot when the manifest fails validation.",
+  "category": "functional",
+  "domain": "edge",
+  "priority": "must",
+  "rationale": "Ratified in the Hetzner round 7 spec (2026-09-07 section 5.3 edge-cloudflare-tunnel-REQ-002). Ships as v1.0.0 of edge-cloudflare-tunnel.",
+  "tags": [
+    "blueprint:edge-cloudflare-tunnel",
+    "capability:tunnelBridge"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/edge-cloudflare-tunnel/contributions/requirements/edge-cloudflare-tunnel-req-003.json

@@ -0,0 +1,18 @@
+{
+  "reqId": "edge-cloudflare-tunnel-REQ-003",
+  "prdId": "PRD-001",
+  "title": "No public origin ports on the host (T-1 firewall stays 22 open plus 80/443 only when a reverse proxy is applied; manifest refuses an origin-port request)",
+  "description": "The applying project MUST NOT open a public port on the host firewall for the origin path when only edge-cloudflare-tunnel provides ingress. T-1 deploy-hetzner-server firewall allows 22 unconditionally and 80/443 only when a reverse proxy is applied. A project applying only T-1 plus T-3 (no reverse proxy) declares zero 80/443 rules; the tunnel manifest schema refuses ingress rules whose service URL binds to a host public interface.",
+  "category": "functional",
+  "domain": "edge",
+  "priority": "must",
+  "rationale": "Ratified in the Hetzner round 7 spec (2026-09-07 section 5.3 edge-cloudflare-tunnel-REQ-003). Ships as v1.0.0 of edge-cloudflare-tunnel.",
+  "tags": [
+    "blueprint:edge-cloudflare-tunnel",
+    "capability:tunnelBridge"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/edge-cloudflare-tunnel/contributions/requirements/edge-cloudflare-tunnel-req-004.json

@@ -0,0 +1,18 @@
+{
+  "reqId": "edge-cloudflare-tunnel-REQ-004",
+  "prdId": "PRD-001",
+  "title": "Access-gated composition: when zeroTrustGate is applied, ingress rules attach originRequest.access.aud; when absent, block omitted and tunnel serves in public-hostname mode",
+  "description": "The blueprint reads the applying project sidecar rcf/blueprints/edge-cloudflare-tunnel.applied.json at apply time and inspects appliedCapabilities. When zeroTrustGate is present every ingress rule attaches an originRequest.access block naming the Access AUD; cloudflared refuses at the edge any request without a valid Access JWT for that AUD. When zeroTrustGate is absent the block is omitted and the tunnel serves in public-hostname mode. The aud-presence-check probe refuses if the shape drifts to open ingress on a project that intended the gated shape.",
+  "category": "functional",
+  "domain": "edge",
+  "priority": "must",
+  "rationale": "Ratified in the Hetzner round 7 spec (2026-09-07 section 5.3 edge-cloudflare-tunnel-REQ-004). Ships as v1.0.0 of edge-cloudflare-tunnel.",
+  "tags": [
+    "blueprint:edge-cloudflare-tunnel",
+    "capability:tunnelBridge"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/edge-cloudflare-tunnel/contributions/requirements/edge-cloudflare-tunnel-req-005.json

@@ -0,0 +1,18 @@
+{
+  "reqId": "edge-cloudflare-tunnel-REQ-005",
+  "prdId": "PRD-001",
+  "title": "Credentials-file discipline: JSON at mode 0o400, referenced via secretRef, not committed, grep-refuse on the literal, no leak in event bodies",
+  "description": "The tunnel credentials JSON file lands on the host at mode 0o400 (owner read only), is referenced from the manifest as a secretRef (never a literal committed file body), MUST NOT be committed to the applying project tree (grep-refuse on the tunnel id and account tag literals across the working tree), and MUST NOT appear in any cloudflaredReady, tunnelConnectorUp or ingressRuleReloaded event body.",
+  "category": "functional",
+  "domain": "edge",
+  "priority": "must",
+  "rationale": "Ratified in the Hetzner round 7 spec (2026-09-07 section 5.3 edge-cloudflare-tunnel-REQ-005). Ships as v1.0.0 of edge-cloudflare-tunnel.",
+  "tags": [
+    "blueprint:edge-cloudflare-tunnel",
+    "capability:tunnelBridge"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/edge-cloudflare-tunnel/contributions/tacs/tac-4001-edge-cloudflare-tunnel-connector-shape.json

@@ -0,0 +1,26 @@
+{
+  "tacId": "TAC-4001-edge-cloudflare-tunnel-connector-shape",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "name": "Edge-cloudflare-tunnel connector install shape",
+  "purpose": "The cloudflared connector installs in one of two runtime shapes as selected by ADR-4002 from the applied capability set. When containerHost is applied (T-2 platform-docker-compose-host on top of T-1 deploy-hetzner-server) the connector ships as a compose service alongside the applying project services on the same web-net network with no host ports and a healthcheck. When the host runs bare (only T-1 applied) the connector ships as a systemd unit per the vendor local-configuration-file docs. Either shape emits cloudflaredReady on boot with connector id, region and version metadata (metadata only).",
+  "responsibilities": [
+    "Ship the compose-service variant under packages/rcf-lite/test/fixtures/hetzner-throwaway-server/cloudflared/compose-service/ (AC-tunnel-connectorShape).",
+    "Ship the systemd-unit variant under packages/rcf-lite/test/fixtures/hetzner-throwaway-server/cloudflared/systemd-unit/ (AC-tunnel-connectorShape).",
+    "Emit cloudflaredReady on boot with connector id, region and version metadata (AC-tunnel-connectorHealthy).",
+    "Never expose an origin port on the host firewall (AC-tunnel-noPublicOrigin)."
+  ],
+  "internalStructure": "One module discovering the applied fixture root and returning both variant paths; consumers walk the compose fragment or the systemd unit file per the applied capability set.",
+  "interfaces": [
+    {
+      "name": "default export",
+      "kind": "facade",
+      "summary": "Connector shape discovery facade exported from the applied fixture module."
+    }
+  ],
+  "dependencies": [],
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/edge-cloudflare-tunnel/contributions/tacs/tac-4002-edge-cloudflare-tunnel-manifest-schema.json

@@ -0,0 +1,26 @@
+{
+  "tacId": "TAC-4002-edge-cloudflare-tunnel-manifest-schema",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "name": "Edge-cloudflare-tunnel manifest schema",
+  "purpose": "The tunnel manifest at cloudflare/tunnels/<name>.yaml under the applying project is the sole runtime source of truth for what the cloudflared connector serves. The shipped JSON schema requires a uuid-shaped tunnel id, a secretRef credentials reference (never a literal path or JSON body inline), and an ingress rules array whose last entry is a catch-all rule returning http_status 404. The schema refuses ingress rules whose service URL binds to a host public interface.",
+  "responsibilities": [
+    "Ship the JSON schema at contributions/probes/tunnel-manifest.schema.json (AC-tunnel-manifestSchema).",
+    "Validate the fixture manifests at cloudflared/*/cloudflare/tunnels/*.yaml on every reviewer boot (AC-tunnel-manifestSchema, AC-tunnel-hostnameRoutes).",
+    "Refuse ingress rules that bind to a host public port (AC-tunnel-noPublicOrigin).",
+    "Refuse a manifest whose credentials reference is not a secretRef (AC-tunnel-manifestSchema, AC-tunnel-credentialsDiscipline)."
+  ],
+  "internalStructure": "One JSON schema plus one probe module; the probe reads the resolved fixture root from env (defaulted to the canonical fixture path) and validates every tunnel yaml against the schema.",
+  "interfaces": [
+    {
+      "name": "default export",
+      "kind": "facade",
+      "summary": "Manifest schema-validate facade exported from the blueprint probe module."
+    }
+  ],
+  "dependencies": [],
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/edge-cloudflare-tunnel/contributions/tacs/tac-4003-edge-cloudflare-tunnel-access-binding.json

@@ -0,0 +1,25 @@
+{
+  "tacId": "TAC-4003-edge-cloudflare-tunnel-access-binding",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "name": "Edge-cloudflare-tunnel Access AUD binding",
+  "purpose": "The blueprint reads the applying project sidecar rcf/blueprints/edge-cloudflare-tunnel.applied.json at apply time and inspects appliedCapabilities. When zeroTrustGate is present every ingress rule attaches an originRequest.access.aud block naming the Access AUD; when absent the block is omitted and the tunnel serves in public-hostname mode. The shape is a pure function of the sidecar and never silently degrades to open ingress.",
+  "responsibilities": [
+    "Ship the aud-presence-check probe module (AC-tunnel-accessGated, AC-tunnel-accessGatedRefuse).",
+    "Ship both fixture variants (access-gated and public-hostname) under cloudflared/sidecars/*.applied.json (AC-tunnel-accessGated).",
+    "Refuse when the gated variant drifts to open ingress (AC-tunnel-accessGatedRefuse)."
+  ],
+  "internalStructure": "One probe module reading the sidecar file resolved from the fixture root and validating the ingress shape flips correctly.",
+  "interfaces": [
+    {
+      "name": "default export",
+      "kind": "facade",
+      "summary": "AUD-presence-check facade exported from the blueprint probe module."
+    }
+  ],
+  "dependencies": [],
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/edge-cloudflare-tunnel/contributions/user-stories/edge-cloudflare-tunnel-us-39101.json

@@ -0,0 +1,24 @@
+{
+  "usId": "edge-cloudflare-tunnel-US-39101",
+  "prdId": "PRD-001",
+  "reqId": "edge-cloudflare-tunnel-REQ-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Connector install shape switches on applied containerHost (compose-service default; systemd-unit fallback for bare cloudHost)",
+  "asA": "shelf consumer applying edge-cloudflare-tunnel v1.0.0 alongside deploy-hetzner-server (and optionally platform-docker-compose-host)",
+  "iWant": "the cloudflared connector to install as a compose service when the containerHost capability is applied and as a systemd unit when the host runs bare",
+  "soThat": "the runtime shape matches the applied platform rather than forcing a container onto a bare host or a bare service into a compose-managed stack",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-tunnel-connectorShape",
+      "description": "The applied fixture ships both variants under packages/rcf-lite/test/fixtures/hetzner-throwaway-server/cloudflared/{compose-service,systemd-unit}/; the compose-service variant defines a cloudflared service on the same web-net network as the T-2 web and caddy services with no host ports, restart unless-stopped and a healthcheck; the systemd-unit variant ships a cloudflared.service unit file per the vendor local-configuration-file docs.",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-4001-edge-cloudflare-tunnel-connector-shape"
+  ],
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/edge-cloudflare-tunnel/contributions/user-stories/edge-cloudflare-tunnel-us-39102.json

@@ -0,0 +1,24 @@
+{
+  "usId": "edge-cloudflare-tunnel-US-39102",
+  "prdId": "PRD-001",
+  "reqId": "edge-cloudflare-tunnel-REQ-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Cloudflared connector reports healthy on boot (tunnelConnectorUp fires with connector id, region, version)",
+  "asA": "shelf consumer applying edge-cloudflare-tunnel v1.0.0 on a cloudHost",
+  "iWant": "the connector to emit a tunnelConnectorUp event on boot with connector id, region and version metadata (metadata only)",
+  "soThat": "the observability sink proves the tunnel is up without a shell into the host",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-tunnel-connectorHealthy",
+      "description": "real-account-connector-healthy probe declares accountBound true (on CI_HAS_CLOUDFLARE_ACCOUNT AND CI_HAS_HETZNER_ACCOUNT) and records accountBoundSkipped when either is unset. When both are set the probe drives cloudflared tunnel info against the fixture tunnel and asserts at least one healthy connector plus a tunnelConnectorUp event with connector id, region and version.",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-4001-edge-cloudflare-tunnel-connector-shape"
+  ],
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/edge-cloudflare-tunnel/contributions/user-stories/edge-cloudflare-tunnel-us-39103.json

@@ -0,0 +1,24 @@
+{
+  "usId": "edge-cloudflare-tunnel-US-39103",
+  "prdId": "PRD-001",
+  "reqId": "edge-cloudflare-tunnel-REQ-002",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Tunnel manifest at cloudflare/tunnels/<name>.yaml validates on shape (uuid tunnel id, secretRef credentials, ingress with catch-all 404)",
+  "asA": "shelf consumer applying edge-cloudflare-tunnel v1.0.0",
+  "iWant": "the tunnel manifest to validate against a shipped JSON schema requiring a uuid-shaped tunnel id, a secretRef credentials reference, and an ingress rules array whose last entry is a mandatory catch-all http_status 404",
+  "soThat": "a mis-shaped manifest is caught at apply-time rather than at first inbound request",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-tunnel-manifestSchema",
+      "description": "manifest-schema-validate probe passes on the canonical fixture and fails when the fixture is mutated (SIMULATE_MANIFEST_INVALID_TUNNEL_ID, SIMULATE_MANIFEST_CREDENTIALS_INLINE, SIMULATE_MANIFEST_MISSING_CATCHALL) naming the offending field.",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-4002-edge-cloudflare-tunnel-manifest-schema"
+  ],
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/edge-cloudflare-tunnel/contributions/user-stories/edge-cloudflare-tunnel-us-39104.json

@@ -0,0 +1,24 @@
+{
+  "usId": "edge-cloudflare-tunnel-US-39104",
+  "prdId": "PRD-001",
+  "reqId": "edge-cloudflare-tunnel-REQ-002",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Cloudflared tunnel ingress validate exits 0 on the fixture manifest (routes public hostname to internal service URL)",
+  "asA": "shelf consumer applying edge-cloudflare-tunnel v1.0.0 with a compose service listening on an internal port",
+  "iWant": "the ingress rule mapping the public hostname to the internal service URL (http://web:8080 in the compose-service variant, http://127.0.0.1:8080 in the systemd-unit variant) to pass cloudflared tunnel ingress validate cleanly",
+  "soThat": "a rule that would fail at boot fails at gate instead",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-tunnel-hostnameRoutes",
+      "description": "cloudflared-config-lint probe runs cloudflared tunnel ingress validate against the fixture manifest (through the cloudflare/cloudflared:2026.8.3 container image when the binary is not on PATH) and exits 0 on the canonical fixture; SIMULATE_INGRESS_INVALID rewrites the service URL to an unresolvable scheme and the probe FAILS.",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-4002-edge-cloudflare-tunnel-manifest-schema"
+  ],
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/edge-cloudflare-tunnel/contributions/user-stories/edge-cloudflare-tunnel-us-39105.json

@@ -0,0 +1,24 @@
+{
+  "usId": "edge-cloudflare-tunnel-US-39105",
+  "prdId": "PRD-001",
+  "reqId": "edge-cloudflare-tunnel-REQ-003",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "No public origin ports on the host (firewall stays 22 open plus 80/443 only when a reverse proxy is applied; manifest refuses origin-port request)",
+  "asA": "shelf consumer applying edge-cloudflare-tunnel v1.0.0 without a reverse proxy",
+  "iWant": "the host firewall to stay closed on 80/443 and the manifest schema to refuse any ingress rule whose service URL binds to a host public interface",
+  "soThat": "the tunnel remains the only path from the edge to the origin",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-tunnel-noPublicOrigin",
+      "description": "manifest-schema-validate refuses under SIMULATE_ORIGIN_PORT_OPEN when an ingress rule service URL binds to 0.0.0.0 or a host public interface; the T-1 firewall on the ci-throwaway manifest stays 22 open plus 80/443 open only when a reverse proxy is applied.",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-4002-edge-cloudflare-tunnel-manifest-schema"
+  ],
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/edge-cloudflare-tunnel/contributions/user-stories/edge-cloudflare-tunnel-us-39106.json

@@ -0,0 +1,24 @@
+{
+  "usId": "edge-cloudflare-tunnel-US-39106",
+  "prdId": "PRD-001",
+  "reqId": "edge-cloudflare-tunnel-REQ-004",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Access-gated composition: zeroTrustGate applied attaches originRequest.access.aud; absent omits the block",
+  "asA": "shelf consumer applying edge-cloudflare-tunnel v1.0.0 alongside edge-cloudflare-access v1.0.0",
+  "iWant": "every ingress rule to attach an originRequest.access block naming the Access AUD when zeroTrustGate is applied and to omit the block when it is not",
+  "soThat": "the shape switches purely on the applied capability set and never silently degrades",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-tunnel-accessGated",
+      "description": "aud-presence-check probe reads each variant sidecar and asserts the ingress rules attach originRequest.access.aud on the access-gated variant and omit the block on the public-hostname variant. The shape flip is a pure function of the sidecar contents.",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-4003-edge-cloudflare-tunnel-access-binding"
+  ],
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/edge-cloudflare-tunnel/contributions/user-stories/edge-cloudflare-tunnel-us-39107.json

@@ -0,0 +1,24 @@
+{
+  "usId": "edge-cloudflare-tunnel-US-39107",
+  "prdId": "PRD-001",
+  "reqId": "edge-cloudflare-tunnel-REQ-004",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Access-gated shape does not silently degrade to open ingress when the AUD block drifts absent (aud-presence-check refuses)",
+  "asA": "shelf consumer who applied edge-cloudflare-tunnel v1.0.0 with zeroTrustGate on",
+  "iWant": "a probe that asserts the ingress rule keeps its originRequest.access.aud block on every reapply and refuses if the block drifts absent",
+  "soThat": "a silent config drift to open ingress is caught at gate rather than at first probing",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-tunnel-accessGatedRefuse",
+      "description": "aud-presence-check FAILS under SIMULATE_AUD_DROP when the gated fixture ingress drifts to omit the originRequest.access block. The finding names the affected rule and the missing AUD value.",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-4003-edge-cloudflare-tunnel-access-binding"
+  ],
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}