rcf-lite 0.25.0 → 0.26.0

package/blueprints/platform-cloudflare-kv/contributions/probes/facade-round-trip.mjs

@@ -7,15 +7,33 @@
 // events fire on the paired operations, then deletes the key and
 // asserts kvMiss fires on a subsequent read.
 //
-// Also covers AC-5102-1 by extending the same run with a list-with-
-// prefix pass over 10 keys under flags/ so the round-trip probe
-// carries the compact case for the list mechanism.
+// Also covers AC-31104-1 by extending the same run with a list-
+// with-prefix pass over 10 keys under flags/ so the round-trip
+// probe carries the compact case for the list mechanism.
 //
-// anchorAcId: AC-5101-1 (primary; AC-5101-2 and AC-5102-1 covered
-// as additional results).
+// AC-31102-1 (env.CACHE dereferenced in exactly one fixture source
+// file) is carried here as a runtime observable: the probe reads
+// the fixture src/ tree at run time and asserts exactly one file
+// (src/kv-facade.mjs) contains the env.CACHE substring. This gives
+// the sole-reader-grep AC a runtime observable in a probe result
+// alongside the anatomy-test assertion (dispatch addendum, first
+// dispatch groundwork note 2).
+//
+// anchorAcId: AC-31103-1 (primary: put/get round-trip and paired
+//   events per US-31103). Additional results cover AC-31101-1
+//   (facadeReady on boot), AC-31103-2 (delete then kvMiss),
+//   AC-31104-1 (list-with-prefix compact case) and AC-31102-1
+//   (sole-reader-grep runtime observable).
 // accountBound: false.
 
-export const anchorAcId = 'AC-5101-1';
+import { readdir, readFile } from 'node:fs/promises';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+const FIXTURE_SRC = resolve(HERE, '..', '..', '..', '..', 'packages', 'rcf-lite', 'test', 'fixtures', 'cf-platform', 'src');
+
+export const anchorAcId = 'AC-31103-1';
 export const accountBound = false;
 
 export default async function runProbe() {
@@ -29,20 +47,21 @@ export default async function runProbe() {
 
   const results = [];
 
-  // AC-5001-1 seam: ready() fires facadeReady with metadata-only
-  // payload. Not the anchor here (that's TS-080 anatomy), but the
-  // signal is worth surfacing.
+  // AC-31101-1 seam: ready() fires facadeReady with metadata-only
+  // payload. Not the primary anchor here, but the signal is worth
+  // surfacing on this probe as an additional result.
   await facade.ready();
   const ready = events.filter((e) => e.event === 'facadeReady');
   results.push({
-    anchorAcId: 'AC-5001-1',
+    anchorAcId: 'AC-31101-1',
     verdict: ready.length === 1 && ready[0].key === null && ready[0].size === 0 ? 'pass' : 'fail',
     detail: ready.length === 1
       ? `facadeReady fired once with key=${ready[0].key} size=${ready[0].size} ttl=${ready[0].ttl} timestamp=${ready[0].timestamp}`
       : `facadeReady expected once, observed ${ready.length}`,
   });
 
-  // AC-5101-1: put/get round-trip returns same bytes and pairs events.
+  // AC-31103-1: put/get round-trip returns same bytes and pairs
+  // paired kvWrite / kvHit events.
   const key = 'kv-facade-round-trip/hello';
   const value = 'hello workers-kv';
   await facade.put(key, value, { metadata: { v: 1 } });
@@ -51,27 +70,29 @@ export default async function runProbe() {
   const hitEvents = events.filter((e) => e.event === 'kvHit');
   const roundTripPass = got === value && writeEvents.length === 1 && hitEvents.length === 1;
   results.push({
-    anchorAcId: 'AC-5101-1',
+    anchorAcId: 'AC-31103-1',
     verdict: roundTripPass ? 'pass' : 'fail',
     detail: roundTripPass
       ? `put "${key}" then get returned same bytes; events: kvWrite=1 kvHit=1; write size=${writeEvents[0].size}`
       : `put/get mismatch: got=${JSON.stringify(got)} kvWrite=${writeEvents.length} kvHit=${hitEvents.length}`,
   });
 
-  // AC-5101-2: delete then get returns null and emits kvMiss.
+  // AC-31103-2: delete then get returns null and emits kvMiss.
   await facade.delete(key);
   const afterDelete = await facade.get(key);
   const missEvents = events.filter((e) => e.event === 'kvMiss');
   const deletePass = afterDelete === null && missEvents.length >= 1;
   results.push({
-    anchorAcId: 'AC-5101-2',
+    anchorAcId: 'AC-31103-2',
     verdict: deletePass ? 'pass' : 'fail',
     detail: deletePass
       ? `delete then get returned null; kvMiss events observed=${missEvents.length}`
       : `delete branch fault: afterDelete=${JSON.stringify(afterDelete)} kvMiss=${missEvents.length}`,
   });
 
-  // AC-5102-1: list with prefix returns all 10 keys with metadata shape.
+  // AC-31104-1: list with prefix returns all 10 keys with metadata
+  // shape. Extended compact case on this probe; list-with-prefix
+  // probe holds the primary anchor.
   const listBinding = createInMemoryKv();
   const listEvents = [];
   const listFacade = createKvFacade({ binding: listBinding, eventSink: (rec) => listEvents.push(rec) });
@@ -81,12 +102,33 @@ export default async function runProbe() {
   const listed = await listFacade.list({ prefix: 'flags/' });
   const listOk = listed.keys.length === 10 && listed.keys.every((k) => typeof k.name === 'string' && k.name.startsWith('flags/') && k.metadata && typeof k.metadata === 'object');
   results.push({
-    anchorAcId: 'AC-5102-1',
+    anchorAcId: 'AC-31104-1',
     verdict: listOk ? 'pass' : 'fail',
     detail: listOk
       ? `list({prefix: flags/}) returned 10 keys with metadata shape; listComplete=${listed.listComplete}`
       : `list-with-prefix fault: keyCount=${listed.keys.length} sample=${JSON.stringify(listed.keys[0])}`,
   });
 
+  // AC-31102-1 runtime observable: grep the fixture src/ tree for
+  // env.CACHE. The dereference must appear in exactly one file
+  // (src/kv-facade.mjs); the raw KV binding must not leak into any
+  // other module (or the future adapter swap would need to move
+  // multiple call sites).
+  const entries = await readdir(FIXTURE_SRC);
+  const hits = [];
+  for (const name of entries) {
+    if (!name.endsWith('.mjs')) continue;
+    const text = await readFile(resolve(FIXTURE_SRC, name), 'utf8');
+    if (text.includes('env.CACHE')) hits.push(name);
+  }
+  const soleReaderPass = hits.length === 1 && hits[0] === 'kv-facade.mjs';
+  results.push({
+    anchorAcId: 'AC-31102-1',
+    verdict: soleReaderPass ? 'pass' : 'fail',
+    detail: soleReaderPass
+      ? `env.CACHE dereferenced in exactly one fixture src/ module: ${hits[0]}`
+      : `sole-reader-grep fault: expected exactly kv-facade.mjs to dereference env.CACHE; observed ${JSON.stringify(hits)}`,
+  });
+
   return { results };
 }

package/blueprints/platform-cloudflare-kv/contributions/probes/list-with-prefix.mjs

@@ -3,13 +3,14 @@
 // Puts 10 keys under the shared prefix flags/ through the facade,
 // calls facade.list({prefix: flags/}), asserts all 10 return with
 // correct metadata shape. Independent of the round-trip probe; the
-// round-trip probe also covers this AC but this probe carries the
-// mechanism as a first-class case for T-1 REQ-002.
+// round-trip probe also covers this AC as an additional result but
+// this probe carries the mechanism as a first-class case for
+// US-31104.
 //
-// anchorAcId: AC-5102-1.
+// anchorAcId: AC-31104-1.
 // accountBound: false.
 
-export const anchorAcId = 'AC-5102-1';
+export const anchorAcId = 'AC-31104-1';
 export const accountBound = false;
 
 export default async function runProbe() {
@@ -42,7 +43,7 @@ export default async function runProbe() {
 
   return {
     results: [{
-      anchorAcId: 'AC-5102-1',
+      anchorAcId: 'AC-31104-1',
       verdict: pass ? 'pass' : 'fail',
       detail: pass
         ? `list({prefix: flags/}) returned 10 keys under the prefix; every entry carries {name, metadata} with metadata.v=1; decoy key outside prefix was NOT included`

package/blueprints/platform-cloudflare-kv/contributions/probes/real-account-eventual-consistency-smoke.mjs

@@ -1,102 +1,166 @@
 // Real-account eventual-consistency smoke for platform-cloudflare-kv
-// v1.0.0.
+// v1.1.0.
 //
-// Opens the facade against a real Cloudflare KV namespace via the
-// Workers KV REST API (per https://developers.cloudflare.com/api/
-// operations/workers-kv-namespace-write-key-value-pair). Writes a
-// fixture key, waits up to 60 seconds bounded (poll every 2s), then
-// reads and asserts the write eventually appears. The probe does
-// NOT bind a specific propagation time; only that a write eventually
-// becomes visible under the 60-second cap. Cleans up the written
-// key on exit.
+// Self-provisioning: the probe mints its own scratch KV namespace via
+// the fixture shim (packages/rcf-lite/test/fixtures/cf-platform/
+// h2-cf-kv-real-account-shim.mjs), writes a fixture key, waits up to
+// 60 seconds bounded (poll every 2s) for the same-region read to see
+// the write, then deletes the key AND destroys the scratch namespace.
+// Positive evidence captured: the CF-assigned namespace id, the exact
+// scratch title used (H-2 prefix "h2-cf-probe-integrity-scratch-kv-"),
+// the scratch key (H-2 prefix "h2-storage-smoke-"), elapsed milli-
+// seconds to first same-region visibility, and the PUT status code.
+// The teardown is fail-safe: a mid-run crash surfaces the scratch id
+// through the shim's persisted record; the shim's sweepOrphans entry
+// point cleans any residue by listing over the account and filtering
+// on the throwaway prefix.
 //
-// accountBound: true. Without CI_HAS_CLOUDFLARE_ACCOUNT (and the
-// paired CF_ACCOUNT_ID, CF_KV_NAMESPACE_ID, CF_API_TOKEN env vars),
-// the probe records accountBoundSkipped: true and the aggregate
-// flips to pass per spec section 3.5.
+// accountBound: true. Without CI_HAS_CLOUDFLARE_ACCOUNT the probe
+// records accountBoundSkipped: true and the aggregate flips to pass
+// per spec section 3.5. With CI_HAS_CLOUDFLARE_ACCOUNT=true the probe
+// either produces positive evidence of execution or fails; no third
+// outcome (dispatch requirement 5).
 //
-// anchorAcId: AC-5401-1.
+// Declared env (dispatch requirement 4): every env var that can cause
+// a skip or an early return is enumerated in report.extra.envDeclared
+// and mirrored in the fixture shim's DECLARED_ENV export. If a new
+// gate is added and does not appear in DECLARED_ENV the anatomy test
+// fails.
+//
+// anchorAcId: AC-31103-1. The eventual-consistency round-trip proves
+// the shipped put/get shape on a real Cloudflare KV namespace,
+// re-covering AC-31103-1 (facade put then get returns the same bytes
+// with paired kvWrite / kvHit events on the shipped binding contract).
+//
+// Local-proof scope (Dave ruling 376b4f30): the local test harness
+// under packages/rcf-lite/test/fixtures/cf-platform/test/ is a mock
+// of Cloudflare's REST contract, not the wire. The local run
+// exercises OUR lifecycle logic against a mock of Cloudflare's
+// contract; the real-account gate is the only surface that proves
+// the wire format. This probe is never described as "locally
+// verified" - the local runs are our own lifecycle-logic proof;
+// wire correctness is proven at the HQ real-account gate.
+
+import {
+  mintScratchNamespace, destroyScratchNamespace,
+  putScratchKey, getScratchKey, deleteScratchKey,
+  generateKey, DECLARED_ENV, NAMESPACE_PREFIX, KEY_PREFIX,
+} from '../../../../packages/rcf-lite/test/fixtures/cf-platform/h2-cf-kv-real-account-shim.mjs';
 
-export const anchorAcId = 'AC-5401-1';
+export const anchorAcId = 'AC-31103-1';
 export const accountBound = true;
 
 const CAP_MS = 60_000;
 const POLL_INTERVAL_MS = 2_000;
-const API_BASE = 'https://api.cloudflare.com/client/v4';
+
+function skipResult(detail) {
+  return {
+    results: [{
+      anchorAcId: 'AC-31103-1',
+      verdict: 'pass',
+      detail,
+      accountBoundSkipped: true,
+    }],
+    extra: {
+      accountBoundSkipped: true,
+      envDeclared: Array.from(DECLARED_ENV),
+      throwawayPrefixes: { namespaceTitle: NAMESPACE_PREFIX, kvKey: KEY_PREFIX },
+    },
+  };
+}
 
 export default async function runProbe() {
   if (process.env.CI_HAS_CLOUDFLARE_ACCOUNT !== 'true') {
+    return skipResult('accountBoundSkipped: CI_HAS_CLOUDFLARE_ACCOUNT is not set to true; spec section 3.5 pass-with-skip. Declared env for a live run: CI_HAS_CLOUDFLARE_ACCOUNT + CF_ACCOUNT_ID + CF_API_TOKEN (CF_API_BASE_URL optional test override).');
+  }
+  if (!process.env.CF_ACCOUNT_ID || !process.env.CF_API_TOKEN) {
     return {
       results: [{
-        anchorAcId: 'AC-5401-1',
-        verdict: 'pass',
-        detail: 'accountBoundSkipped: CI_HAS_CLOUDFLARE_ACCOUNT is not set to true; spec section 3.5 pass-with-skip.',
+        anchorAcId: 'AC-31103-1',
+        verdict: 'fail',
+        detail: `CI_HAS_CLOUDFLARE_ACCOUNT=true but one of CF_ACCOUNT_ID / CF_API_TOKEN is missing: accountIdPresent=${!!process.env.CF_ACCOUNT_ID} tokenPresent=${!!process.env.CF_API_TOKEN}.`,
       }],
-      extra: { accountBoundSkipped: true },
+      extra: {
+        envDeclared: Array.from(DECLARED_ENV),
+        throwawayPrefixes: { namespaceTitle: NAMESPACE_PREFIX, kvKey: KEY_PREFIX },
+      },
     };
   }
 
-  const accountId = process.env.CF_ACCOUNT_ID;
-  const namespaceId = process.env.CF_KV_NAMESPACE_ID;
-  const token = process.env.CF_API_TOKEN;
-  if (!accountId || !namespaceId || !token) {
+  const runId = process.env.GITHUB_RUN_ID || `local-${Date.now()}`;
+  let namespace = null;
+  const evidence = {
+    envDeclared: Array.from(DECLARED_ENV),
+    throwawayPrefixes: { namespaceTitle: NAMESPACE_PREFIX, kvKey: KEY_PREFIX },
+    runId,
+  };
+  try {
+    namespace = await mintScratchNamespace({ runId });
+    evidence.namespaceId = namespace.id;
+    evidence.namespaceTitle = namespace.title;
+  } catch (err) {
     return {
       results: [{
-        anchorAcId: 'AC-5401-1',
+        anchorAcId: 'AC-31103-1',
         verdict: 'fail',
-        detail: `CI_HAS_CLOUDFLARE_ACCOUNT=true but one of CF_ACCOUNT_ID/CF_KV_NAMESPACE_ID/CF_API_TOKEN is missing: accountIdPresent=${!!accountId} namespaceIdPresent=${!!namespaceId} tokenPresent=${!!token}`,
+        detail: `mintScratchNamespace failed: ${err.message}`,
       }],
+      extra: evidence,
     };
   }
 
-  const key = `platform-cloudflare-kv/real-account-smoke/${Date.now()}`;
+  const key = generateKey({ runId });
   const value = `smoke-${Math.random().toString(36).slice(2)}`;
-  const putUrl = `${API_BASE}/accounts/${accountId}/storage/kv/namespaces/${namespaceId}/values/${encodeURIComponent(key)}`;
-  const authHeaders = { authorization: `Bearer ${token}`, 'content-type': 'text/plain' };
+  evidence.key = key;
+  evidence.valueSample = value;
 
-  const putResp = await fetch(putUrl, { method: 'PUT', headers: authHeaders, body: value });
-  if (!putResp.ok) {
-    return {
-      results: [{
-        anchorAcId: 'AC-5401-1',
-        verdict: 'fail',
-        detail: `real-account smoke: PUT returned status ${putResp.status}`,
-      }],
-    };
-  }
+  try {
+    const put = await putScratchKey({ namespaceId: namespace.id, key, value });
+    evidence.putStatus = put.status;
 
-  const start = Date.now();
-  let observed = null;
-  while (Date.now() - start < CAP_MS) {
-    const getResp = await fetch(putUrl, { method: 'GET', headers: { authorization: `Bearer ${token}` } });
-    if (getResp.ok) {
-      const body = await getResp.text();
-      if (body === value) {
-        observed = body;
+    const start = Date.now();
+    let observed = null;
+    while (Date.now() - start < CAP_MS) {
+      const got = await getScratchKey({ namespaceId: namespace.id, key });
+      if (got.ok && got.text === value) {
+        observed = got.text;
+        evidence.getStatusOnHit = got.status;
         break;
       }
+      await new Promise((r) => setTimeout(r, POLL_INTERVAL_MS));
     }
-    await new Promise((r) => setTimeout(r, POLL_INTERVAL_MS));
-  }
+    const elapsed = Date.now() - start;
+    evidence.elapsedMs = elapsed;
+    evidence.capMs = CAP_MS;
 
-  const elapsed = Date.now() - start;
+    // Delete the scratch key regardless of outcome; the namespace
+    // destroy in the finally block would remove it anyway, but the
+    // per-key delete proves the delete verb on the shipped path.
+    try {
+      const del = await deleteScratchKey({ namespaceId: namespace.id, key });
+      evidence.deleteStatus = del.status;
+    } catch (err) {
+      evidence.deleteError = err.message;
+    }
 
-  // Clean up the written key regardless of outcome.
-  try {
-    await fetch(putUrl, { method: 'DELETE', headers: { authorization: `Bearer ${token}` } });
-  } catch (_err) {
-    // Best effort; do not fail the probe on cleanup.
+    const pass = observed === value;
+    return {
+      results: [{
+        anchorAcId: 'AC-31103-1',
+        verdict: pass ? 'pass' : 'fail',
+        detail: pass
+          ? `real-account KV eventual-consistency: mint namespace ${namespace.id} (${namespace.title}); PUT key ${key} (status ${evidence.putStatus}); write eventually appeared on same-region GET within elapsed=${elapsed}ms (CAP=${CAP_MS}ms); DELETE key (status ${evidence.deleteStatus ?? 'unset'}); namespace destroyed on teardown.`
+          : `real-account KV eventual-consistency: mint namespace ${namespace.id} (${namespace.title}); PUT key ${key} (status ${evidence.putStatus}); write did NOT appear within CAP=${CAP_MS}ms; elapsed=${elapsed}ms.`,
+      }],
+      extra: evidence,
+    };
+  } finally {
+    try {
+      const teardown = await destroyScratchNamespace(namespace);
+      evidence.namespaceDestroyed = teardown.destroyed;
+    } catch (err) {
+      evidence.teardownError = err.message;
+      process.stderr.write(`h2-cf-kv probe: teardown failed for namespace ${namespace && namespace.id}: ${err.message}; sweepOrphans will collect on next run.\n`);
+    }
   }
-
-  const pass = observed === value;
-  return {
-    results: [{
-      anchorAcId: 'AC-5401-1',
-      verdict: pass ? 'pass' : 'fail',
-      detail: pass
-        ? `write eventually appeared on the same-region read within elapsed=${elapsed}ms (CAP=${CAP_MS}ms)`
-        : `write did not appear within CAP=${CAP_MS}ms; elapsed=${elapsed}ms`,
-    }],
-    extra: { elapsedMs: elapsed, cap: CAP_MS },
-  };
 }

package/blueprints/platform-cloudflare-kv/docs/topics.md

@@ -46,7 +46,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
 | application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
 | persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
-| object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.1.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
 | platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |

package/blueprints/platform-docker-compose-host/docs/topics.md

@@ -46,7 +46,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
 | application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
 | persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
-| object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.1.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
 | platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |

package/blueprints/security-auth-clerk/docs/topics.md

@@ -46,7 +46,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
 | application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
 | persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
-| object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.1.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
 | platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |

package/blueprints/security-auth-keycloak/docs/topics.md

@@ -57,7 +57,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
 | application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
 | persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
-| object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.1.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
 | platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |

package/blueprints/security-auth-magic-link/docs/topics.md

@@ -46,7 +46,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
 | application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
 | persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
-| object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.1.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
 | platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |

package/blueprints/security-auth-oauth2/docs/topics.md

@@ -57,7 +57,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
 | application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
 | persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
-| object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.1.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
 | platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |

package/blueprints/security-secrets-management/docs/topics.md

@@ -46,7 +46,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
 | application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
 | persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
-| object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.1.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
 | platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |

package/fixtures/canary-manifest.json

@@ -1,9 +1,9 @@
 {
   "registerCanary": [
     {
-      "id": "rc-2026-09-08-001",
-      "createdAt": "2026-09-08T05:23:05.136Z",
-      "buildVersion": "0.25.0-mockdriver",
+      "id": "rc-2026-09-09-001",
+      "createdAt": "2026-09-09T16:11:26.221Z",
+      "buildVersion": "0.26.0-mockdriver",
       "fixturePromptId": "canary-prompt-01",
       "responseWordCount": 55,
       "grades": {
@@ -34,9 +34,9 @@
       "shipDespiteFailReason": "mock canary driver used; no real subagent was dispatched. This record verifies canary infrastructure only, not the register itself."
     },
     {
-      "id": "rc-2026-09-08-002",
-      "createdAt": "2026-09-08T05:23:05.137Z",
-      "buildVersion": "0.25.0-mockdriver",
+      "id": "rc-2026-09-09-002",
+      "createdAt": "2026-09-09T16:11:26.222Z",
+      "buildVersion": "0.26.0-mockdriver",
       "fixturePromptId": "canary-prompt-02",
       "responseWordCount": 55,
       "grades": {
@@ -67,9 +67,9 @@
       "shipDespiteFailReason": "mock canary driver used; no real subagent was dispatched. This record verifies canary infrastructure only, not the register itself."
     },
     {
-      "id": "rc-2026-09-08-003",
-      "createdAt": "2026-09-08T05:23:05.137Z",
-      "buildVersion": "0.25.0-mockdriver",
+      "id": "rc-2026-09-09-003",
+      "createdAt": "2026-09-09T16:11:26.222Z",
+      "buildVersion": "0.26.0-mockdriver",
       "fixturePromptId": "canary-prompt-03",
       "responseWordCount": 55,
       "grades": {

package/guidance/harness-template.md

@@ -252,6 +252,73 @@ miss, feed unreachable) say nothing to the operator; freshness is a
 convenience, not a gate. Never run the upgrade without the operator's
 explicit go.
 
+### RULE 15: On blueprint apply, dispose every AC.
+
+A blueprint's acceptance criteria come in two shapes: `fixed`
+(mechanism-invariant, true for every applying project) and `template`
+(shape given, values project-specific). When you apply a blueprint
+(`rcf define blueprint add ...`), walk every AC the blueprint
+contributed. A `fixed` AC stands as authored: do not weaken or drop
+one, and if one appears wrong for the project, that is a defect against
+the blueprint, escalated on the blueprint's repo, not edited locally. A
+`template` AC is a starting shape: actively dispose of it by accepting
+as written, adjusting with the project's values, or dropping with a
+stated reason recorded against the story. Silent inheritance of a
+`template` AC is a defect. After you have disposed of every `template`
+AC, re-sweep the applied AC set against the scenario-class prompt list
+(credential missing, non-2xx, rate limit, timeout, partial write,
+permission denied, malformed input, already exists, gone, concurrent
+access, quota exhausted, dependency not ready, first-vs-repeat run,
+idempotency, empty and maximal collections, boundary values) so the
+story still covers the mechanism's documented failure paths. Any AC
+that rests on a third-party platform fact must show its vendor
+documentation URL and the ISO-8601 date the fact was verified; a
+citation older than the operator's tolerance is re-verified before the
+AC is treated as ground truth.
+
+A blueprint's seed docs are a minimal representational seed set, not a
+project spec. You have full scope of the project you are driving, and
+you are the party best placed to integrate the seed with the project's
+own chain. After you have disposed of every AC, walk the seed's REQs,
+TACs and ADRs against the project chain (existing REQs, TACs, ADRs and
+the PRD/TAD): resolve integration contradictions you can (parameter
+substitution against a settled project value, naming reconciliation
+against a settled project convention, composition-order reconciliation
+against another applied blueprint), record the disposition in the
+tree, and escalate to the operator only the ones that need a
+product-shape decision or a two-way credential or account decision. An
+internal contradiction (two of the seed's own layers disagreeing about
+the same contract) is not yours to resolve; escalate it as a defect
+against the blueprint's repo and refuse to derive downstream work from
+the ambiguity.
+
+When you escalate, pitch the question at the operator's declared
+register. On your first exchange after `rcf init`, if
+`rcf/.identity/profile.md` carries no `operatorRegister` value, ask one
+question and record the answer to the profile: "One quick set-up
+question. When we need to escalate a decision to you, do you want it
+framed as a product-owner question (plain English, outcome-shaped) or
+an engineer question (with the AC id, the seed's assertion, the
+project's convention)? Answer 'product owner', 'engineer', or 'skip'
+and I will hold the default." A `skip` answer writes `unstated`, which
+reads as `productOwner` on the first escalation; if the operator
+answers in method vocabulary, silently promote to `engineer` for the
+rest of the session and offer to persist the change to the profile.
+
+### RULE 16: Verify with positive evidence.
+
+Every "verified" claim (in the Test and Finalise stages, in the PR body's
+verification section, in any status update) names the runtime it was
+checked against AND cites the positive evidence of the property (a
+request id, a response body excerpt, a created-then-deleted resource id
+in an inventory diff, a real deploy record). "The check did not show the
+bad signature" is not evidence; "the request returned id 8f7a-... and
+the response body carried the created resource id 12345" is. Where the
+account credentials are not present, record the skip honestly (name the
+env var that was unset), never fabricate a pass on the strength of
+absence. This rule mirrors RULE 15's active-disposition posture: an
+absent check is a skip you name, an actual check is a claim you cite.
+
 ### Session start
 
 Run `rcf define validate`. A broken tree is fixed or reported before anything

package/guidance/managed/agent-instructions-block.hash

@@ -1 +1 @@
-129f4018f526ececaef7ae5bea19ecd72be03a957e2cf2ee3323e85f117f6cba
+d35bd2dfec14db5567c2bcfa2934ce58ac5d7c23fd24e47776501660e06063eb