rcf-lite 0.25.0 → 0.26.0

package/blueprints/edge-cloudflare-tunnel/contributions/probes/manifest-schema-validate.mjs

@@ -112,7 +112,10 @@ async function eventSecrecyScan(credentialsPath) {
   try {
     creds = JSON.parse(await readFile(credentialsPath, 'utf8'));
   } catch (err) {
-    return { verdict: 'warn', detail: `credentials placeholder read failed: ${err.message}` };
+    return {
+      verdict: 'fail',
+      detail: `credentials placeholder read failed at ${credentialsPath}: ${err.message}. Fix the fixture setup step (packages/rcf-lite/test/fixtures/hetzner-throwaway-server/cloudflared/*/credentials/probe.json.example must exist and parse as JSON) before re-running the probe. A missing placeholder is a fixture-setup defect, not an event-secrecy warning.`,
+    };
   }
   const eventBody = {
     kind: 'cloudflaredReady',

package/blueprints/edge-cloudflare-tunnel/contributions/probes/real-account-connector-healthy.mjs

@@ -1,27 +1,44 @@
 // Probe: real-account-connector-healthy.
 //
-// anchorAcId: AC-tunnel-connectorHealthy.
-// accountBound: true (gates on CI_HAS_CLOUDFLARE_ACCOUNT AND CI_HAS_HETZNER_ACCOUNT).
+// anchorAcId: AC-tunnel-connectorHealthy (US-39102 contribution;
+// real-account-connector-healthy declared with tunnelConnectorUp).
+// C4 ruling: the AC-tunnel-* symbolic anchors on the tunnel blueprint
+// ARE the AC ids in the shipped US-39101..US-39108 contribution band
+// (see blueprints/edge-cloudflare-tunnel/contributions/user-stories/
+// edge-cloudflare-tunnel-us-3910N.json); the anchors already resolve
+// to the shipped band, so no re-anchor is performed by H-2. The kv
+// treatment differed because those probes anchored AC-5xxx ids that
+// existed nowhere on the shelf; here the ids exist and match by
+// design.
 //
-// Without both env vars the probe records accountBoundSkipped: true and
-// the aggregate flips to pass per hetzner-round-7-spec section 3.5.
+// accountBound: true (gates on CI_HAS_CLOUDFLARE_ACCOUNT AND
+// CI_HAS_HETZNER_ACCOUNT; the connector runs on a throwaway Hetzner
+// server).
 //
-// With both env vars the probe (not exercised in this dispatch; the
-// blueprint author has no account tokens per the dispatch envelope):
-// - Provisions a throwaway Hetzner server via the shared fixture
-//   provision.mjs (T-1 verb).
-// - Stands up cloudflared against a scratch Cloudflare subdomain and asks
-//   the api for `cloudflared tunnel info <name>`; asserts at least one
-//   healthy connector.
-// - Captures a tunnelConnectorUp event with connector id, region and
-//   version metadata (metadata only).
-// - Tears down via destroy.mjs in an always() block.
+// Env-absent branch: pass-with-skip (spec section 3.5).
+// Env-present branch: provisions a throwaway Hetzner server through
+// the shared T-1 fixture provisionThrowawayServer, drives the
+// cloudflared control surface through the cf-edge shim's
+// cloudflaredTunnelInfo({ tunnelName }) call, asserts at least one
+// HEALTHY connector, and captures a tunnelConnectorUp event
+// (metadata-only: connector id, region, version). If the fixture
+// provisioning throws (missing HCLOUD_TOKEN, quota, etc.), the
+// probe FAILS with a pointer naming the fixture step: the tunnel
+// connector cannot report healthy on a server that never provisioned.
+//
+// The shim seams (cloudflaredTunnelInfo, event capture) allow the
+// driver path and mutation switches to be exercised locally without
+// a real Cloudflare account; the real-account run happens at HQ
+// gate time.
 
 import { runShim, accountBoundSkippedResult } from './probe-utils.mjs';
 
 export const anchorAcIds = ['AC-tunnel-connectorHealthy'];
 export const accountBound = true;
 
+const TUNNEL_NAME_ENV = 'CF_TUNNEL_NAME';
+const DEFAULT_TUNNEL_NAME = 'h2-cf-probe-integrity-scratch';
+
 export default async function runProbe() {
   const results = [];
   const extra = {
@@ -30,6 +47,7 @@ export default async function runProbe() {
       CI_HAS_CLOUDFLARE_ACCOUNT: process.env.CI_HAS_CLOUDFLARE_ACCOUNT === 'true',
       CI_HAS_HETZNER_ACCOUNT: process.env.CI_HAS_HETZNER_ACCOUNT === 'true',
     },
+    events: [],
   };
   const hasAll = extra.envPresent.CI_HAS_CLOUDFLARE_ACCOUNT && extra.envPresent.CI_HAS_HETZNER_ACCOUNT;
   if (!hasAll) {
@@ -40,15 +58,86 @@ export default async function runProbe() {
     ));
     return { results, extra };
   }
-  results.push({
-    anchorAcId: 'AC-tunnel-connectorHealthy',
-    verdict: 'warn',
-    detail: 'account-bound path present in this dispatch environment but not exercised by the blueprint-author role; run under the delivery-ci-workflows lane with the account tokens loaded.',
-  });
-  return { results, extra };
+
+  // Env-present path: real driver. All account-bound work runs through
+  // the cf-edge shim, which itself delegates to the hetzner fixture in
+  // production and returns synthetic responses under the fixture-side
+  // H2_CF_TUNNEL_SHIM_MODE token. Probe body reads no mutation-switch
+  // env var and imports no fixture module directly.
+  const {
+    provisionScratchServer, destroyScratchServer, cloudflaredTunnelInfo,
+  } = await import(
+    '../../../../packages/rcf-lite/test/fixtures/cf-edge/h2-cf-tunnel-shim.mjs'
+  );
+
+  const runId = process.env.GITHUB_RUN_ID || `local-${Date.now()}`;
+  let provisioned = null;
+  try {
+    provisioned = await provisionScratchServer({ runId });
+    extra.provisioned = {
+      id: provisioned.id, name: provisioned.name, location: provisioned.location, shimMode: provisioned.shimMode,
+    };
+  } catch (err) {
+    results.push({
+      anchorAcId: 'AC-tunnel-connectorHealthy',
+      verdict: 'fail',
+      detail: `fixture provisionScratchServer failed: ${err.message}. The tunnel connector cannot report healthy on a server that never provisioned. Fix the fixture step (packages/rcf-lite/test/fixtures/hetzner-throwaway-server/provision.mjs) or the account tokens (HCLOUD_TOKEN) before re-running.`,
+    });
+    return { results, extra };
+  }
+
+  try {
+    const tunnelName = process.env[TUNNEL_NAME_ENV] || DEFAULT_TUNNEL_NAME;
+    extra.tunnelName = tunnelName;
+    let info;
+    try {
+      info = await cloudflaredTunnelInfo({ tunnelName });
+    } catch (err) {
+      results.push({
+        anchorAcId: 'AC-tunnel-connectorHealthy',
+        verdict: 'fail',
+        detail: `cloudflared tunnel info shim call failed: ${err.message}. Fix the cf-edge shim (packages/rcf-lite/test/fixtures/cf-edge/h2-cf-tunnel-shim.mjs) or the cloudflared control surface before re-running.`,
+      });
+      return { results, extra };
+    }
+    extra.shimMode = info.shimMode;
+    extra.connectorCount = info.connectors.length;
+    const healthy = info.connectors.filter((c) => String(c.status || '').toUpperCase() === 'HEALTHY');
+    if (healthy.length === 0) {
+      results.push({
+        anchorAcId: 'AC-tunnel-connectorHealthy',
+        verdict: 'fail',
+        detail: `cloudflared tunnel info returned ${info.connectors.length} connector(s), none HEALTHY. Statuses observed: ${info.connectors.map((c) => String(c.status || 'MISSING')).join(', ') || '(no connectors)'}.`,
+      });
+      return { results, extra };
+    }
+    // Capture tunnelConnectorUp event, metadata only (id, region, version).
+    for (const c of healthy) {
+      extra.events.push({
+        kind: 'tunnelConnectorUp',
+        connectorId: String(c.id ?? ''),
+        region: String(c.region ?? ''),
+        version: String(c.version ?? ''),
+      });
+    }
+    results.push({
+      anchorAcId: 'AC-tunnel-connectorHealthy',
+      verdict: 'pass',
+      detail: `cloudflared tunnel info returned ${info.connectors.length} connector(s), ${healthy.length} HEALTHY (shim mode ${info.shimMode}); tunnelConnectorUp event captured for each healthy connector with metadata-only payload (connectorId, region, version).`,
+    });
+    return { results, extra };
+  } finally {
+    // Always attempt teardown; a failed teardown is a fixture concern
+    // and rides sweep-orphans, not this probe.
+    try {
+      await destroyScratchServer(provisioned);
+    } catch (_err) {
+      // Best-effort; the nightly sweep-orphans job collects any leak.
+    }
+  }
 }
 
-const engine = { kind: 'real-account-cloudflared-info', image: 'cloudflared + hcloud (throwaway server)', healthy: true };
+const engine = { kind: 'real-account-cloudflared-info', image: 'cloudflared + hcloud (throwaway server) via cf-edge shim', healthy: true };
 if (import.meta.url === `file://${process.argv[1]}`) {
   await runShim('real-account-connector-healthy', engine, runProbe);
 }

package/blueprints/edge-cloudflare-tunnel/contributions/probes/real-account-tunnel-hostname-routes.mjs

@@ -1,28 +1,45 @@
 // Probe: real-account-tunnel-hostname-routes.
 //
-// anchorAcId list:
-// - AC-tunnel-hostnameRoutes (public-hostname sub-case)
-// - AC-tunnel-accessGated (access-gated sub-case, gated on CI_HAS_CLOUDFLARE_ACCESS)
-// accountBound: true (CI_HAS_CLOUDFLARE_ACCOUNT AND CI_HAS_HETZNER_ACCOUNT for
-// the public-hostname sub-case; add CI_HAS_CLOUDFLARE_ACCESS for the
-// access-gated sub-case per Q4 ratification).
+// anchorAcId list (unchanged per H-2 C4 ruling; the AC-tunnel-* ids
+// ARE the shipped AC ids in the US-39104 / US-39106 contribution
+// bodies):
+// - AC-tunnel-hostnameRoutes (public-hostname sub-case: ingress rule
+//   routes public hostname to internal service URL and returns 200).
+// - AC-tunnel-accessGated (access-gated sub-case: Access-gated
+//   composition; unauthenticated request refused, JWT-carrying
+//   request accepted; per US-39106).
 //
-// Without the env vars the sub-cases skip independently and each records
-// accountBoundSkipped: true. The aggregate flips to pass per hetzner-
-// round-7-spec section 3.5.
+// accountBound: true.
+// Gating (amendment 4 verbatim):
+// - Public-hostname sub-case activated on CI_HAS_CLOUDFLARE_ACCOUNT
+//   AND CI_HAS_HETZNER_ACCOUNT.
+// - Access-gated sub-case activated only when CI_HAS_CLOUDFLARE_ACCESS
+//   is ALSO set. Env-absent branch keeps pass-with-skip; a pass must
+//   never be reachable from CI_HAS_CLOUDFLARE_ACCOUNT presence alone.
+// - HQ note: Cloudflare Access is not enabled on the HQ account, so
+//   at gate time the AUD sub-case stays pass-with-skip; expected,
+//   not a driver defect.
 //
-// With the env vars (not exercised in this dispatch; the blueprint
-// author has no account tokens per the dispatch envelope):
-// - Public-hostname sub-case: undici curl against the scratch subdomain,
-//   asserts 200 and the internal service payload.
-// - Access-gated sub-case: two fixture identities; the JWT-less request
-//   is refused at the edge; the JWT-carrying request proceeds.
+// Env-present, sub-case active: undici-based fetch driver against the
+// scratch subdomain via the cf-edge shim (production path uses Node's
+// built-in fetch; shim-synthetic path lets local runs exercise the
+// driver body without account access). For the access-gated
+// sub-case: send an unauthenticated request (must be refused with
+// 4xx) AND a JWT-carrying request (must be accepted with 2xx). A
+// pass requires BOTH results.
 
 import { runShim, accountBoundSkippedResult } from './probe-utils.mjs';
 
 export const anchorAcIds = ['AC-tunnel-hostnameRoutes', 'AC-tunnel-accessGated'];
 export const accountBound = true;
 
+const PUBLIC_URL_ENV = 'CF_TUNNEL_PUBLIC_URL';
+const ACCESS_URL_ENV = 'CF_TUNNEL_ACCESS_URL';
+const ACCESS_AUDIENCE_ENV = 'CF_ACCESS_AUDIENCE';
+const ACCESS_TEAM_SECRET_ENV = 'CF_ACCESS_TEAM_SECRET';
+const DEFAULT_PUBLIC_URL = 'https://h2-cf-public.scratch.example.invalid/health';
+const DEFAULT_ACCESS_URL = 'https://h2-cf-gated.scratch.example.invalid/protected';
+
 export default async function runProbe() {
   const results = [];
   const extra = {
@@ -38,36 +55,112 @@ export default async function runProbe() {
   };
   const hasPublic = extra.envPresent.CI_HAS_CLOUDFLARE_ACCOUNT && extra.envPresent.CI_HAS_HETZNER_ACCOUNT;
   const hasGated = hasPublic && extra.envPresent.CI_HAS_CLOUDFLARE_ACCESS;
+
   if (!hasPublic) {
     results.push(accountBoundSkippedResult(
       'AC-tunnel-hostnameRoutes',
       ['CI_HAS_CLOUDFLARE_ACCOUNT', 'CI_HAS_HETZNER_ACCOUNT'],
-      'public-hostname sub-case: undici curl against the scratch subdomain not exercised. Set CI_HAS_CLOUDFLARE_ACCOUNT=true AND CI_HAS_HETZNER_ACCOUNT=true to run this path.',
+      'public-hostname sub-case: undici fetch against the scratch subdomain not exercised. Set CI_HAS_CLOUDFLARE_ACCOUNT=true AND CI_HAS_HETZNER_ACCOUNT=true to run this path.',
     ));
-  } else {
-    results.push({
-      anchorAcId: 'AC-tunnel-hostnameRoutes',
-      verdict: 'warn',
-      detail: 'public-hostname sub-case: account-bound path present but not exercised by the blueprint-author role; run under the delivery-ci-workflows lane.',
-    });
   }
   if (!hasGated) {
     results.push(accountBoundSkippedResult(
       'AC-tunnel-accessGated',
       ['CI_HAS_CLOUDFLARE_ACCOUNT', 'CI_HAS_HETZNER_ACCOUNT', 'CI_HAS_CLOUDFLARE_ACCESS'],
-      'access-gated sub-case: two-identity JWT check against the scratch subdomain not exercised. Requires all three env vars (CI_HAS_CLOUDFLARE_ACCESS added per Q4 ratification).',
+      'access-gated sub-case: two-identity JWT check against the scratch subdomain not exercised. Requires all three env vars; a pass here is unreachable from CI_HAS_CLOUDFLARE_ACCOUNT presence alone (amendment 4 verbatim).',
     ));
-  } else {
-    results.push({
-      anchorAcId: 'AC-tunnel-accessGated',
-      verdict: 'warn',
-      detail: 'access-gated sub-case: account-bound path present but not exercised by the blueprint-author role; run under the delivery-ci-workflows lane.',
-    });
   }
+  if (!hasPublic && !hasGated) {
+    return { results, extra };
+  }
+
+  // Sub-case active: load the shim seams.
+  const { fetchTunnelHostname, mintScratchIdentity } = await import(
+    '../../../../packages/rcf-lite/test/fixtures/cf-edge/h2-cf-tunnel-shim.mjs'
+  );
+
+  if (hasPublic) {
+    const url = process.env[PUBLIC_URL_ENV] || DEFAULT_PUBLIC_URL;
+    extra.publicHostnameUrl = url;
+    try {
+      const resp = await fetchTunnelHostname(url, { method: 'GET' });
+      extra.publicHostnameResponse = { status: resp.status, shimMode: resp.shimMode, bodyLength: resp.textBody.length };
+      if (resp.status >= 200 && resp.status < 300) {
+        results.push({
+          anchorAcId: 'AC-tunnel-hostnameRoutes',
+          verdict: 'pass',
+          detail: `public-hostname sub-case: fetch(${url}) returned ${resp.status} (shim mode ${resp.shimMode}), body length ${resp.textBody.length}. Ingress rule routes the public hostname to the internal service URL.`,
+        });
+      } else {
+        results.push({
+          anchorAcId: 'AC-tunnel-hostnameRoutes',
+          verdict: 'fail',
+          detail: `public-hostname sub-case: fetch(${url}) returned ${resp.status} (shim mode ${resp.shimMode}). Expected 2xx; the ingress rule did not route the public hostname to a healthy internal service.`,
+        });
+      }
+    } catch (err) {
+      results.push({
+        anchorAcId: 'AC-tunnel-hostnameRoutes',
+        verdict: 'fail',
+        detail: `public-hostname sub-case: fetch(${url}) threw: ${err.message}. Check the scratch subdomain, the tunnel manifest ingress rules, or the cf-edge shim.`,
+      });
+    }
+  }
+
+  if (hasGated) {
+    const url = process.env[ACCESS_URL_ENV] || DEFAULT_ACCESS_URL;
+    const audience = process.env[ACCESS_AUDIENCE_ENV] || 'h2-cf-scratch-audience';
+    const secret = process.env[ACCESS_TEAM_SECRET_ENV] || 'h2-cf-scratch-team-secret';
+    extra.accessGatedUrl = url;
+    let refusalResp;
+    let acceptResp;
+    try {
+      refusalResp = await fetchTunnelHostname(url, { method: 'GET' });
+    } catch (err) {
+      results.push({
+        anchorAcId: 'AC-tunnel-accessGated',
+        verdict: 'fail',
+        detail: `access-gated sub-case: unauthenticated fetch(${url}) threw: ${err.message}.`,
+      });
+      return { results, extra };
+    }
+    try {
+      const jwt = mintScratchIdentity({ audience, subject: 'h2-cf-scratch-identity', secret });
+      acceptResp = await fetchTunnelHostname(url, {
+        method: 'GET',
+        headers: { authorization: `Bearer ${jwt}` },
+      });
+    } catch (err) {
+      results.push({
+        anchorAcId: 'AC-tunnel-accessGated',
+        verdict: 'fail',
+        detail: `access-gated sub-case: JWT-carrying fetch(${url}) threw: ${err.message}.`,
+      });
+      return { results, extra };
+    }
+    extra.accessGatedRefusal = { status: refusalResp.status, shimMode: refusalResp.shimMode };
+    extra.accessGatedAccept = { status: acceptResp.status, shimMode: acceptResp.shimMode };
+    const refused = refusalResp.status >= 400 && refusalResp.status < 500;
+    const accepted = acceptResp.status >= 200 && acceptResp.status < 300;
+    if (refused && accepted) {
+      results.push({
+        anchorAcId: 'AC-tunnel-accessGated',
+        verdict: 'pass',
+        detail: `access-gated sub-case: unauthenticated request refused with ${refusalResp.status} and JWT-carrying request accepted with ${acceptResp.status} (shim mode ${refusalResp.shimMode}). Access gate composed correctly.`,
+      });
+    } else {
+      results.push({
+        anchorAcId: 'AC-tunnel-accessGated',
+        verdict: 'fail',
+        detail: `access-gated sub-case: expected 4xx-then-2xx; observed refusal status ${refusalResp.status} and JWT-accept status ${acceptResp.status} (shim mode ${refusalResp.shimMode}). Gate is drifted: unauthenticated request should be refused and JWT request accepted.`,
+      });
+    }
+  }
+
   return { results, extra };
 }
 
-const engine = { kind: 'real-account-tunnel-curl', image: 'undici + cloudflared (scratch subdomain)', healthy: true };
+const engine = { kind: 'real-account-tunnel-fetch', image: 'undici fetch + cf-edge shim (scratch subdomain)', healthy: true };
 if (import.meta.url === `file://${process.argv[1]}`) {
   await runShim('real-account-tunnel-hostname-routes', engine, runProbe);
 }

package/blueprints/edge-cloudflare-tunnel/docs/topics.md

@@ -46,7 +46,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
 | application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
 | persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
-| object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.1.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
 | platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |

package/blueprints/edge-cloudflare-turnstile/docs/topics.md

@@ -46,7 +46,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
 | application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
 | persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
-| object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.1.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
 | platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |

package/blueprints/email-smtp-resend/docs/topics.md

@@ -42,7 +42,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
 | application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
 | persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
-| object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.1.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
 | platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |

package/blueprints/jobs-background/docs/topics.md

@@ -43,7 +43,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | application-empty-error-states | 22101-22899 | 23xx | shipped v1.0.0 | none |
 | application-file-upload | 23101-23899 | 24xx | shipped v1.0.0 | none |
 | persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
-| object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.1.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
 | platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |

package/blueprints/messaging-queue-cloudflare/CHANGELOG.md

@@ -1,5 +1,24 @@
 # messaging-queue-cloudflare changelog
 
+## 1.0.2 - 2026-09-08
+
+H-2 follow-up (`w-2026-09-08-dave-017`, addendum item 6 fixture defect): the real-account queue probe now self-provisions its own throwaway Queue + consumer Worker + telemetry KV namespace, closing the second-tier undeclared-env skip HQ hit at the real-account gate on 2026-09-08 (`REAL RUN: PARTIAL`, `MERGE DECISION: HOLD`). No shipped-code capability change.
+
+- `real-account-concurrency-smoke.mjs` rewritten against a new self-provisioning fixture shim at `packages/rcf-lite/test/fixtures/cf-platform/h2-cf-queue-real-account-shim.mjs`. AC-29108-2 requires a real consumer to process the published messages ("the consumer processes them concurrently up to the documented 250-invocation cap"), so the shim mints a scratch Cloudflare Queue under `h2-cf-probe-integrity-scratch-q-`, a scratch KV namespace for consumer telemetry under `h2-cf-probe-integrity-scratch-kv-tel-`, and a throwaway consumer Worker under `h2-cf-probe-integrity-scratch-w-` bound to the queue (consumer) with `RCF_TEST_QUEUE` (shipped queue producer binding name matching `packages/rcf-lite/test/fixtures/infra-s3-and-queue/wrangler.toml`) + `RCF_TEST_TELEMETRY_KV` bindings. NO workers.dev subdomain is enabled (Dave ruling 376b4f30): the consumer is invoked BY THE QUEUE, not over HTTP; the driver publishes via the Cloudflare Queues REST publish endpoint and reads consumer telemetry via the KV REST list + get endpoints. The consumer Worker's source is a plain module (`h2-cf-queue-consumer-worker.mjs`); its `queue()` handler records one telemetry entry per invocation (start / end timestamps + batchSize) to the bound telemetry KV namespace; the driver computes `maxConcurrent` from an interval-overlap analysis on those timestamps.
+- Declared env for a real-account run is now `CI_HAS_CLOUDFLARE_ACCOUNT` + `CF_ACCOUNT_ID` + `CF_API_TOKEN` (optional `CF_API_BASE_URL` test override; optional `CF_QUEUE_MESSAGE_COUNT` per section 3.5). The `CF_QUEUE_WORKER_URL` and `CF_QUEUE_NAME` second-tier gates are removed; the fixture provides them itself. Every skip-causing env var enumerated in `report.extra.envDeclared` on the probe result and mirrored in the shim's `DECLARED_ENV` export.
+- Teardown deletes the consumer Worker first (so the queue has no active consumer at delete time), then the Queue, then the telemetry KV namespace, all by EXACT id / EXACT name against the mint record with three independent prefix guards per resource. `workerDelete` and `queueDelete` are idempotent on 404 (Dave ruling 4e9ff62d items 3+4): a botched-retry teardown treats an already-gone resource as success rather than stranding siblings.
+- Separate crash-recovery `sweepOrphans` code path filters over the account by the frozen throwaway prefix constants and deletes each match by exact identity; the sweep is structurally unable to select a non-prefixed name. All account listings paginate to completion (Dave ruling 4e9ff62d item 5): KV namespaces + Queues use the documented `per_page` + `page` loop, Workers scripts use the cursor loop, so `sweepOrphans` is not silently truncated to page one on a busy account. Dedicated sweep-safety test at `packages/rcf-lite/test/fixtures/cf-platform/test/h2-cf-sweep-safety.test.mjs` seeds the mock account with the ten live production Worker script names on the operator account plus mid-string-prefix decoys AND a 250-per-type multi-page cover, and asserts sweep selects zero of them.
+- Queue consumer-attach body sends `type: "worker"` (Dave ruling 4e9ff62d item 1: survives CF schema tightening on the discriminated attach union) and omits `dead_letter_queue` entirely rather than sending an explicit `null` (item 2).
+- Local proof harness (`packages/rcf-lite/test/fixtures/cf-platform/test/mock-cf-api-server.mjs`) is a zero-dep in-process mock of the Cloudflare REST contract, not the wire. **The local run exercises OUR lifecycle logic against a mock of Cloudflare's contract; the real-account gate is the only surface that proves the wire format.** The probe is therefore never described as "locally verified" - the local runs are our own lifecycle-logic proof; wire correctness is proven at the HQ real-account gate.
+
+## 1.0.1 - 2026-09-08
+
+H-2 hardening train (`h2-cf-platform-probe-integrity`): probe-integrity patch. No capability change.
+
+- Replaced the `accountBoundSkipped: true` pass-stub in `real-account-concurrency-smoke.mjs` with a real 500-message concurrency driver against a live Queues binding on a deployed Worker. When `CI_HAS_CLOUDFLARE_ACCOUNT` is set with `CF_QUEUE_WORKER_URL` and `CF_QUEUE_NAME`, the driver publishes 500 messages through the producer facade in 10 concurrent 50-message batches, polls consumer telemetry via `/stats`, and asserts `drained`, `withinCap` and `observedConcurrency > 1` against Cloudflare's documented push-invocation cap (250). The env-absent branch keeps the pass-with-skip shape. Locally proven against `wrangler dev --local` end-to-end (500/500 messages in 583 ms; local queue serialises so the concurrency assertion FAIL tail is the expected local-proof outcome; on real Cloudflare push consumers the assertion passes at HQ gate time).
+- Re-verified the Cloudflare Queues limits URL (`https://developers.cloudflare.com/queues/platform/limits/`) returns `HTTP/2 200`; recorded in the H-2 PR provenance (2026-09-08T13:38:07Z).
+- Extended the fixture Worker at `packages/rcf-lite/test/fixtures/infra-s3-and-queue/src/worker.mjs` with consumer telemetry and `/publish-batch`, `/stats` and `/reset` endpoints; added `wrangler ^4.0.0` as devDep on the fixture package.
+
 ## 1.0.0 - 2026-09-06
 
 Initial release. Directed producer-to-consumer worklist queue on Cloudflare Queues; first shipped adapter with the reserved `messaging-queue-postgres` sibling (Baz decision 7) named beside it in the section 6a capability table. Accessed through a producer facade that is the sole reader of the Cloudflare Queues binding (`env.RCF_TEST_QUEUE` in the fixture). Landed via the infra round 5 spec (ratified 2026-09-06) as track T-3.

package/blueprints/messaging-queue-cloudflare/README.md

@@ -60,7 +60,7 @@ Each probe is a Node module under `contributions/probes/` exporting the round-5
 | `publish-to-delivery` | AC-29102-1, AC-29102-2, AC-29105-1, AC-29108-1 | 5 messages round-trip body byte-equal with stable message-ids and producer-supplied trace-ids preserved; per-message ack; wrangler-dev-equivalent seam. | false |
 | `retry-and-dlq` | AC-29103-1, AC-29104-1 | Consumer returning `retry` observes same stable message-id with attempts 1..max_retries; DLQ landing fires `messageDeadLettered` at `max_retries + 1`; DLQ contents body byte-equal via the DLQ inspector helper. | false |
 | `event-secrecy` | AC-29106-1 | Every event record carries only the whitelist (event, ts, messageId, queueName, attempts); no PII fixture text on JSON grep. | false |
-| `real-account-concurrency-smoke` | AC-29108-2 | Real 500-message round-trip against `rcf-lite-ci-queue-smoke` when `CI_HAS_CLOUDFLARE_ACCOUNT` set; records `accountBoundSkipped: true` when not. | true |
+| `real-account-concurrency-smoke` | AC-29108-2 | Self-provisioning (v1.0.2): the fixture shim (`packages/rcf-lite/test/fixtures/cf-platform/h2-cf-queue-real-account-shim.mjs`) mints a scratch Cloudflare Queue under the H-2 prefix `h2-cf-probe-integrity-scratch-q-`, a scratch KV namespace for consumer telemetry under `h2-cf-probe-integrity-scratch-kv-tel-`, and a throwaway consumer Worker under `h2-cf-probe-integrity-scratch-w-` bound to the queue (consumer) with `RCF_TEST_QUEUE` (shipped queue binding name) + `RCF_TEST_TELEMETRY_KV` bindings. The Worker has NO fetch surface and NO workers.dev subdomain is enabled (Dave ruling 376b4f30): the consumer is invoked BY THE QUEUE, not over HTTP. Driver publishes 500 messages in 10 concurrent 50-message batches via the Cloudflare Queues REST publish endpoint, polls the telemetry KV namespace via the KV REST list + get endpoints until drained, and asserts `totalConsumed === published` and `1 < maxConcurrent <= 250` per https://developers.cloudflare.com/queues/platform/limits/. Teardown deletes Worker, Queue and telemetry KV namespace on exit; the shim's separate `sweepOrphans` path lists over the account with full pagination (Dave ruling 4e9ff62d item 5) and deletes any prefixed residue after a mid-run crash. **The local proof exercises OUR lifecycle logic against a mock of Cloudflare's contract; the real-account gate is the only surface that proves the wire format.** Without `CI_HAS_CLOUDFLARE_ACCOUNT` records `accountBoundSkipped: true`. | true |
 
 ## Anatomy
 
@@ -111,7 +111,7 @@ Two live paths are unproven at v1.0.0 and are recorded per AC below so the gate
 - **AC-29105-1** (batch consume: 5 messages in one batch, per-message ack semantics under `max_batch_size = 10`): proven against the in-memory realisation of the binding shape (probe `publish-to-delivery`, verdict pass); live Queues `max_batch_size` / `max_batch_timeout` behaviour on the [[queues.consumers]] block unproven pending a reviewer `wrangler dev` run or the accountBound smoke.
 - **AC-29106-1** (metadata-only event whitelist; no PII body / header value / consumer context leaks): proven end-to-end against the in-memory realisation (probe `event-secrecy`, verdict pass; the whitelist is code-enforced in `src/event-sink.mjs`, independent of transport); live-Queues run does not change the sink code path, so this AC has no live-only gap.
 - **AC-29108-1** (wrangler-dev-equivalent seam round-trip): proven end-to-end against the in-memory realisation of the binding shape (probe `publish-to-delivery`, verdict pass); a live `wrangler dev` process was not driven in this pass. Rationale: SDR-3-a on US-29107 makes the wrangler-dev-equivalent seam the shipped local seam because Cloudflare Queues does not support consumer concurrency under `wrangler dev` and does not support `wrangler dev --remote` per the local-development doc, so a live-wrangler run adds observability (a real process on port 8787) but does not add facade-contract certainty over the in-memory realisation. The gate reviewer drives one live `wrangler dev` run in their own scratch to close the observability gap.
-- **AC-29108-2** (real-account concurrency smoke: 500 messages, consumer concurrency up to 250): NOT proven at v1.0.0 without `CI_HAS_CLOUDFLARE_ACCOUNT`. The probe records `accountBoundSkipped: true` per spec section 3.5 and the per-blueprint report carries `aggregateVerdict: pass` on the skipped shape. The live 500-message run rides `deploy-cloudflare-workers`' surface (Cloudflare Queues does not support `wrangler dev --remote` per the local-development doc, so this cannot ride a local wrangler process even with the env var set); the live run is a v1.0.0 follow-up when the shared HQ queue `rcf-lite-ci-queue-smoke` (Q2 default) is provisioned on Baz's account.
+- **AC-29108-2** (real-account concurrency smoke: 500 messages, consumer concurrency up to 250): as of v1.0.2 the probe SELF-PROVISIONS the throwaway Queue + consumer Worker + telemetry KV namespace under the H-2 prefixes and requires no hand-provisioned CI infrastructure (`w-2026-09-08-dave-017`). Declared env for a live run: `CI_HAS_CLOUDFLARE_ACCOUNT` + `CF_ACCOUNT_ID` + `CF_API_TOKEN`. Without `CI_HAS_CLOUDFLARE_ACCOUNT` the probe records `accountBoundSkipped: true` per spec section 3.5 and the per-blueprint report carries `aggregateVerdict: pass` on the skipped shape. **The local proof harness under `packages/rcf-lite/test/fixtures/cf-platform/test/` is a mock of Cloudflare's REST contract, not the wire; the local runs exercise OUR lifecycle logic against that mock, and the real-account gate is the only surface that proves the wire format.**
 
 ## Other limitations (not mechanism-reach gaps)
 

package/blueprints/messaging-queue-cloudflare/blueprint.json

@@ -1,6 +1,6 @@
 {
   "slug": "messaging-queue-cloudflare",
-  "version": "1.0.0",
+  "version": "1.0.2",
   "category": "messaging",
   "capabilities": ["queue"],
   "suggestedCompanions": [