rcf-lite 0.25.0 → 0.26.0

package/guidance/managed/agent-instructions-block.md

@@ -239,6 +239,73 @@ miss, feed unreachable) say nothing to the operator; freshness is a
 convenience, not a gate. Never run the upgrade without the operator's
 explicit go.
 
+### RULE 15: On blueprint apply, dispose every AC.
+
+A blueprint's acceptance criteria come in two shapes: `fixed`
+(mechanism-invariant, true for every applying project) and `template`
+(shape given, values project-specific). When you apply a blueprint
+(`rcf define blueprint add ...`), walk every AC the blueprint
+contributed. A `fixed` AC stands as authored: do not weaken or drop
+one, and if one appears wrong for the project, that is a defect against
+the blueprint, escalated on the blueprint's repo, not edited locally. A
+`template` AC is a starting shape: actively dispose of it by accepting
+as written, adjusting with the project's values, or dropping with a
+stated reason recorded against the story. Silent inheritance of a
+`template` AC is a defect. After you have disposed of every `template`
+AC, re-sweep the applied AC set against the scenario-class prompt list
+(credential missing, non-2xx, rate limit, timeout, partial write,
+permission denied, malformed input, already exists, gone, concurrent
+access, quota exhausted, dependency not ready, first-vs-repeat run,
+idempotency, empty and maximal collections, boundary values) so the
+story still covers the mechanism's documented failure paths. Any AC
+that rests on a third-party platform fact must show its vendor
+documentation URL and the ISO-8601 date the fact was verified; a
+citation older than the operator's tolerance is re-verified before the
+AC is treated as ground truth.
+
+A blueprint's seed docs are a minimal representational seed set, not a
+project spec. You have full scope of the project you are driving, and
+you are the party best placed to integrate the seed with the project's
+own chain. After you have disposed of every AC, walk the seed's REQs,
+TACs and ADRs against the project chain (existing REQs, TACs, ADRs and
+the PRD/TAD): resolve integration contradictions you can (parameter
+substitution against a settled project value, naming reconciliation
+against a settled project convention, composition-order reconciliation
+against another applied blueprint), record the disposition in the
+tree, and escalate to the operator only the ones that need a
+product-shape decision or a two-way credential or account decision. An
+internal contradiction (two of the seed's own layers disagreeing about
+the same contract) is not yours to resolve; escalate it as a defect
+against the blueprint's repo and refuse to derive downstream work from
+the ambiguity.
+
+When you escalate, pitch the question at the operator's declared
+register. On your first exchange after `rcf init`, if
+`rcf/.identity/profile.md` carries no `operatorRegister` value, ask one
+question and record the answer to the profile: "One quick set-up
+question. When we need to escalate a decision to you, do you want it
+framed as a product-owner question (plain English, outcome-shaped) or
+an engineer question (with the AC id, the seed's assertion, the
+project's convention)? Answer 'product owner', 'engineer', or 'skip'
+and I will hold the default." A `skip` answer writes `unstated`, which
+reads as `productOwner` on the first escalation; if the operator
+answers in method vocabulary, silently promote to `engineer` for the
+rest of the session and offer to persist the change to the profile.
+
+### RULE 16: Verify with positive evidence.
+
+Every "verified" claim (in the Test and Finalise stages, in the PR body's
+verification section, in any status update) names the runtime it was
+checked against AND cites the positive evidence of the property (a
+request id, a response body excerpt, a created-then-deleted resource id
+in an inventory diff, a real deploy record). "The check did not show the
+bad signature" is not evidence; "the request returned id 8f7a-... and
+the response body carried the created resource id 12345" is. Where the
+account credentials are not present, record the skip honestly (name the
+env var that was unset), never fabricate a pass on the strength of
+absence. This rule mirrors RULE 15's active-disposition posture: an
+absent check is a skip you name, an actual check is a claim you cite.
+
 ### Session start
 
 Run `rcf define validate`. A broken tree is fixed or reported before anything

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rcf-lite",
-  "version": "0.25.0",
+  "version": "0.26.0",
   "type": "module",
   "description": "One-install tooling for the Requirements Confidence Framework (RCF): the unified `rcf` CLI grouped into the five RCF tool groups (discover, define, build, verify, audit) plus a small core set (init, doctor, guidance, mcp), an MCP server, the live tree viewer and the fresh-context adversarial ship-gate verifier. Consumes @stravica-ai/rcf-schemas.",
   "license": "Apache-2.0",
@@ -60,7 +60,7 @@
     "#admissibility": "./src/admissibility/index.js"
   },
   "dependencies": {
-    "@stravica-ai/rcf-schemas": "0.6.1",
+    "@stravica-ai/rcf-schemas": "0.6.2",
     "ajv": "^8.20.0",
     "ajv-formats": "^3.0.1"
   },

package/rcf/code-nodes/cn-500.json

@@ -0,0 +1,12 @@
+{
+  "cnId": "CN-500",
+  "path": "../../blueprints/object-storage-s3/blueprint.json",
+  "implementsAcIds": [
+    "AC-14001-1"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-08T09:04:04.994Z",
+  "updatedAt": "2026-09-08T09:04:04.994Z"
+}

package/rcf/code-nodes/cn-510.json

@@ -0,0 +1,12 @@
+{
+  "cnId": "CN-510",
+  "path": "../../blueprints/deploy-hetzner-server/blueprint.json",
+  "implementsAcIds": [
+    "AC-14501-1"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-08T10:52:56.753Z",
+  "updatedAt": "2026-09-08T10:52:56.753Z"
+}

package/rcf/code-nodes/cn-520.json

@@ -0,0 +1,14 @@
+{
+  "cnId": "CN-520",
+  "path": "../../blueprints/platform-cloudflare-kv/blueprint.json",
+  "implementsAcIds": [
+    "AC-15001-1",
+    "AC-15001-2",
+    "AC-15401-2"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-08T12:22:33.507Z",
+  "updatedAt": "2026-09-08T12:23:01.646Z"
+}

package/rcf/code-nodes/cn-521.json

@@ -0,0 +1,12 @@
+{
+  "cnId": "CN-521",
+  "path": "../../packages/rcf-lite/test/fixtures/cf-platform/h2-cf-kv-cache-aside-shim.mjs",
+  "implementsAcIds": [
+    "AC-15401-1"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-08T12:22:47.292Z",
+  "updatedAt": "2026-09-08T12:23:44.676Z"
+}

package/rcf/code-nodes/cn-522.json

@@ -0,0 +1,13 @@
+{
+  "cnId": "CN-522",
+  "path": "../../packages/rcf-lite/test/blueprint/platform-cloudflare-kv-anatomy.test.js",
+  "implementsAcIds": [
+    "AC-15001-1",
+    "AC-15001-2"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-08T12:22:47.694Z",
+  "updatedAt": "2026-09-08T12:22:47.694Z"
+}

package/rcf/code-nodes/cn-523.json

@@ -0,0 +1,12 @@
+{
+  "cnId": "CN-523",
+  "path": "../../packages/rcf-lite/test/fixtures/cf-platform/h2-cf-kv-event-secrecy-shim.mjs",
+  "implementsAcIds": [
+    "AC-15401-1"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-08T12:23:45.054Z",
+  "updatedAt": "2026-09-08T12:23:45.054Z"
+}

package/rcf/code-nodes/cn-524.json

@@ -0,0 +1,14 @@
+{
+  "cnId": "CN-524",
+  "path": "../../blueprints/platform-cloudflare-durable-objects/blueprint.json",
+  "implementsAcIds": [
+    "AC-15101-1",
+    "AC-15101-2",
+    "AC-15401-3"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-08T13:01:58.227Z",
+  "updatedAt": "2026-09-08T13:01:58.227Z"
+}

package/rcf/code-nodes/cn-525.json

@@ -0,0 +1,12 @@
+{
+  "cnId": "CN-525",
+  "path": "../../blueprints/messaging-queue-cloudflare/blueprint.json",
+  "implementsAcIds": [
+    "AC-15201-1"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-08T13:01:58.602Z",
+  "updatedAt": "2026-09-08T13:01:58.602Z"
+}

package/rcf/code-nodes/cn-526.json

@@ -0,0 +1,14 @@
+{
+  "cnId": "CN-526",
+  "path": "../../blueprints/edge-cloudflare-tunnel/blueprint.json",
+  "implementsAcIds": [
+    "AC-15301-1",
+    "AC-15301-2",
+    "AC-15301-3"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-08T13:01:58.994Z",
+  "updatedAt": "2026-09-08T13:01:58.994Z"
+}

package/rcf/fbs/fbs-160.json

@@ -0,0 +1,15 @@
+{
+  "createdAt": "2026-09-08T09:03:37.649Z",
+  "updatedAt": "2026-09-08T09:03:57.443Z",
+  "acIds": [
+    "AC-14001-1"
+  ],
+  "fbsId": "FBS-160",
+  "prdId": "PRD-001",
+  "bsId": "BS-001",
+  "buildOrder": 63,
+  "executionStatus": "notStarted",
+  "title": "Adapter object-storage-s3 v1.1.0 Hetzner Object Storage: minor bump adds hetznerObjectStorage provider; new hetzner-endpoint helper on the fixture side; new hetzner-object-storage-round-trip probe (accountBound gated on CI_HAS_HETZNER_OBJECT_STORAGE); MinIO round-5 T-2 probes and R2 smoke unchanged",
+  "summary": "HQ round-7 follow-up: object-storage-s3 v1.1.0 minor bump adding the Hetzner Object Storage provider value under the shipped S3-API facade contract (blueprints/object-storage-s3/, was 1.0.0). Delta contributions on the blueprint side (target 4): one blueprint REQ object-storage-s3-REQ-101 (Hetzner endpoint-shape contract), one blueprint US object-storage-s3-US-28110 with AC-28110-1 (labelled AC-hetznerObjectStorage-endpointRoundTrip), one blueprint TAC TAC-2904-object-storage-s3-hetzner-endpoint-helper, one blueprint ADR ADR-2905-object-storage-s3-hetzner-object-storage-provider with standardsTraceClause 'Hetzner Object Storage S3 compatibility documented endpoint shape'. Every existing v1.0.0 contribution id byte-identical (no renumber, no reshape). Extends the shared fixture packages/rcf-lite/test/fixtures/infra-s3-and-queue/ (no second fixture directory) with src/hetzner-endpoint.mjs (composes <bucket>.<location>.your-objectstorage.com from an elicited bucket and location per Hetzner storage overview fsn1/hel1/nbg1 codes) plus a fixture-side shim run-hetzner-object-storage-round-trip.mjs. New Node-only probe blueprints/object-storage-s3/contributions/probes/hetzner-object-storage-round-trip.mjs (accountBound true, gated on CI_HAS_HETZNER_OBJECT_STORAGE, records accountBoundSkipped when unset per spec section 3.5); mutation SIMULATE_HETZNER_ENDPOINT_MISSHAPEN true (fixture-side INPUT-side mutation) composes an invalid endpoint via the fixture shim and the probe FAILS naming the missing subdomain. The round-5 T-2 shipped probes (facade-round-trip, put-get-round-trip, presigned-url, multipart-upload, event-secrecy) and the R2 real-account smoke stay unchanged and continue to pass byte-identical on the extended fixture. Blueprint README extended with a Hetzner Object Storage sub-section under the provider-choice section; guide extended with a Hetzner sub-section; blueprint CHANGELOG gains a 1.1.0 entry; shelf-wide topics.md sweep updates the object-storage-s3 row from shipped v1.0.0 to shipped v1.1.0 across every blueprint's docs/topics.md per the round-6 admin-console 1.1.0 precedent (PR #169). rcf-lite package version does NOT bump for this follow-up (spec section 8). Repo chain: REQ-140, US-14001 with AC-14001-1, TS-170 with TC-170-hetzner-endpoint-round-trip-and-skipped-shape, FBS-160 (buildOrder 63), CN-500, plus blueprint REQ-101 and blueprint US-28110 as blueprint-owned deltas, minted via rcf define create --id per HQ round-7 follow-up reserved-block ruling 2026-09-08 (adapter block REQ-140..144 / TS-170..174 / FBS-160..164 / CN-500..509). Base commit origin/main 25ccece.",
+  "dependsOnFbsIds": []
+}

package/rcf/fbs/fbs-165.json

@@ -0,0 +1,15 @@
+{
+  "createdAt": "2026-09-08T10:52:49.604Z",
+  "updatedAt": "2026-09-08T10:52:49.604Z",
+  "summary": "H-1 patch train against deploy-hetzner-server (blueprint bump 1.0.0 to 1.0.1; every existing contribution id byte-identical) and the shared throwaway-Hetzner-server fixture at packages/rcf-lite/test/fixtures/hetzner-throwaway-server/. Defect list from projects/blueprint-library/reports/real-account-r7-2026-09-08/README.md CONCERNS: (1) provision.mjs reads camelCase off the hcloud JSON (publicNet.ipv4.ip, datacenter.location.name, serverType.name) but hcloud emits snake_case (public_net, server_type, datacenter.location.name); fix reads s.public_net.ipv4.ip, s.datacenter.location.name, s.server_type.name; (2) provision.mjs expects hetzner/servers/rendered/ci-throwaway.cloud-init.yaml that nothing writes; fix renders inline via src/cloud-init-renderer.mjs before hcloud server create fires; (3) renderer substitutes ssh key NAMES into ssh_authorized_keys; fix resolves each name to its public-key material via hcloud ssh-key describe <name> --output json and inlines the .publicKey text; (4) destroy.mjs and sweep-orphans.mjs pass --output json to delete verbs that reject the flag; fix drops it and the tolerant JSON parser accepts arrays; (5) src/snapshot-verb.mjs calls a non-existent hcloud image create-image; fix shells hcloud server create-image --type snapshot --description <label> <id> and recovers the created snapshot id via hcloud image list --type=snapshot --output json by matching the serverName label; (6) src/ssh-baseline-check.mjs runs ssh immediately after provisionThrowawayServer; fix polls port 22 open plus a trivial ssh true exec, bounded up to 6 minutes, before firing the six baseline checks; (7) the deploy user has no NOPASSWD sudo in the rendered user-data; fix adds a write_files sudoers.d fragment granting NOPASSWD to that user with mode 0440; (9) hetzner/servers/ci-throwaway.json hard-codes sshKeyIds ['rcf-lite-ci']; fix adds an env override RCF_LITE_CI_SSH_KEY_NAME resolved at provision time with the manifest value as default, documented in the fixture README. Defect (8) T-2 and T-3 stub drivers are OUT of scope (H-2 owns them). Also: hcloud-dry-run-mock and the two other T-1 mocked probes gain fixture-side SIMULATE_ switches that alter INPUT only, satisfying the mutation-purity gate row; the mock reads the same rendered cloud-init the real path consumes and asserts an ssh public-key line and a NOPASSWD directive for the deploy user. Report envelopes under .rcf/reports/blueprints/deploy-hetzner-server/ regenerated from the REAL run under Baz one-off approval 2026-09-08 (repo-relative paths only, no secrets). CHANGELOG 1.0.1 entry lists the fixes by defect number. Chain: HQ hardening block H-1 REQ-145..149 / TS-175..179 / FBS-165..169 / CN-510..519 per HQ chain-block ruling 2026-09-08. Base commit origin/main 231bc74.",
+  "acIds": [
+    "AC-14501-1"
+  ],
+  "fbsId": "FBS-165",
+  "prdId": "PRD-001",
+  "bsId": "BS-001",
+  "buildOrder": 64,
+  "executionStatus": "notStarted",
+  "title": "H-1 hardening: deploy-hetzner-server v1.0.0 to v1.0.1 patch train; fixes the nine defects the round-7 real-account gate run d-2026-09-08-010 found; makes the shared throwaway-server fixture consume the same rendered cloud-init the real path consumes",
+  "dependsOnFbsIds": []
+}

package/rcf/fbs/fbs-170.json

@@ -0,0 +1,16 @@
+{
+  "createdAt": "2026-09-08T12:22:31.659Z",
+  "updatedAt": "2026-09-08T14:04:50.163Z",
+  "acIds": [
+    "AC-15001-1",
+    "AC-15001-2"
+  ],
+  "fbsId": "FBS-170",
+  "prdId": "PRD-001",
+  "bsId": "BS-001",
+  "buildOrder": 65,
+  "executionStatus": "notStarted",
+  "title": "H-2 kv re-anchor and observability: five kv probes and README anchored to shipped AC-31xxx band; two previously-uncovered ACs gain runtime observables via facade-round-trip env.CACHE grep and event-secrecy whitelist scan; kv-anatomy test assertions moved with the re-anchor (addendum ruling 1)",
+  "summary": "H-2 kv re-anchor: renumber every anchorAcId in the five contributed kv probes (facade-round-trip, list-with-prefix, cache-aside-hit-then-miss, event-secrecy, real-account-eventual-consistency-smoke) and their header comments from AC-5xxx to the shipped AC-31xxx band; correct the kv README chain-slice pointer paragraph to name US-31101..US-31108; move kv-anatomy test assertions to the new AC-31xxx ids per dispatch addendum ruling 1; add a runtime env.CACHE-grep result on facade-round-trip covering AC-31102-1; add a whitelist-scan result on event-secrecy covering AC-31107-1; the real-account probe carries AC-31103-1 as its bound AC. Two ACs on this FBS: AC-15001-1 (no AC-5xxx string survives on the kv blueprint tree) and AC-15001-2 (every shipped kv AC appears as an anchor on a probe result with a runtime observable).",
+  "dependsOnFbsIds": []
+}

package/rcf/fbs/fbs-171.json

@@ -0,0 +1,16 @@
+{
+  "createdAt": "2026-09-08T12:22:32.025Z",
+  "updatedAt": "2026-09-08T14:04:49.784Z",
+  "acIds": [
+    "AC-15101-1",
+    "AC-15101-2"
+  ],
+  "fbsId": "FBS-171",
+  "prdId": "PRD-001",
+  "bsId": "BS-001",
+  "buildOrder": 66,
+  "executionStatus": "notStarted",
+  "title": "H-2 DO real storage round-trip driver and anchor coverage: real-account-storage-smoke replaces credential-readiness pass-stub with byte-equal put/get round-trip via deployed Worker (or wrangler-dev locally); five previously-unbound DO ACs bound as additional-result anchors on existing probes; DO anatomy test assertions extended for the new bindings",
+  "summary": "H-2 DO storage round-trip driver and anchor coverage: replace the credential-readiness pass-stub in blueprints/platform-cloudflare-durable-objects/contributions/probes/real-account-storage-smoke.mjs with a real HTTP round-trip driver against a deployed Worker route (byte-equal read-back on 1 KiB payload); local proof via the existing wrangler-seam.mjs against miniflare or wrangler dev. Bind the five previously-unbound DO ACs (AC-33106-1, AC-33108-1, AC-33109-1, AC-33110-1, AC-33111-1) as additional-result anchors on the wrangler-seam, storage-round-trip and concurrent-increment probes; add a new probe body inside existing capability only if no existing probe carries the observable honestly. Extend the DO anatomy test to assert the thirteen-AC coverage union. Move the DO probe-body SIMULATE_ branches (sole-reader-scan, storage-round-trip, websocket-hub-broadcast) into fixture-side h2-cf shim modules (Group B scope, tracked by AC-15401-1).",
+  "dependsOnFbsIds": []
+}

package/rcf/fbs/fbs-172.json

@@ -0,0 +1,15 @@
+{
+  "createdAt": "2026-09-08T12:22:32.405Z",
+  "updatedAt": "2026-09-08T14:04:49.404Z",
+  "acIds": [
+    "AC-15201-1"
+  ],
+  "fbsId": "FBS-172",
+  "prdId": "PRD-001",
+  "bsId": "BS-001",
+  "buildOrder": 67,
+  "executionStatus": "notStarted",
+  "title": "H-2 queue real concurrency driver: real-account-concurrency-smoke publishes 500 messages against a live Queues binding on a deployed Worker and asserts concurrent processing up to the documented push-invocation cap; env-absent branch keeps pass-with-skip; queue anatomy test assertions extended",
+  "summary": "H-2 queue real concurrency driver: replace the accountBoundSkipped pass-stub in blueprints/messaging-queue-cloudflare/contributions/probes/real-account-concurrency-smoke.mjs with a real driver that publishes 500 messages through the producer facade wired to a live Queues binding on a deployed Worker (queue name and binding parameterised via env; canonical queue rcf-lite-ci-queue-smoke, HQ supplies values at gate time) and asserts concurrent processing up to the documented push-invocation cap (Cloudflare Queues limits URL). Local proof via miniflare or wrangler dev with local queue simulation. Env-absent branch keeps section 3.5 pass-with-skip. Re-verify the Cloudflare Queues limits URL 200 at merge time and log in the PR provenance. Extend the queue anatomy test to assert the real-account round-trip shape.",
+  "dependsOnFbsIds": []
+}

package/rcf/fbs/fbs-173.json

@@ -0,0 +1,17 @@
+{
+  "createdAt": "2026-09-08T12:22:32.784Z",
+  "updatedAt": "2026-09-08T14:04:49.011Z",
+  "acIds": [
+    "AC-15301-1",
+    "AC-15301-2",
+    "AC-15301-3"
+  ],
+  "fbsId": "FBS-173",
+  "prdId": "PRD-001",
+  "bsId": "BS-001",
+  "buildOrder": 68,
+  "executionStatus": "notStarted",
+  "title": "H-2 tunnel real drivers: connector-healthy runs cloudflared tunnel info against a throwaway hetzner server via T-1 fixture; hostname-routes drives undici + (with Access) two-identity JWT; manifest-schema-validate placeholder becomes fail-with-pointer; tunnel anatomy test assertions extended and the symbolic-anchor ruling recorded",
+  "summary": "H-2 tunnel real drivers: replace blueprints/edge-cloudflare-tunnel/contributions/probes/real-account-connector-healthy.mjs and real-account-tunnel-hostname-routes.mjs warn-on-env stubs with real drivers. connector-healthy provisions the throwaway hetzner server via the T-1 hetzner fixture surface (consumed as-is; hetzner-fixture defects are H-1 scope at HQ), brings a named cloudflared tunnel connector up, runs cloudflared tunnel info <name> through a cloudflared control shim, asserts healthy connector count is at least one, captures tunnelConnectorUp event. hostname-routes drives undici for the public-hostname sub-case and (when CI_HAS_CLOUDFLARE_ACCESS is set) a two-identity JWT sub-case (HQ note: Access is not enabled on the HQ account today, so at gate time the AUD sub-case stays pass-with-skip until HQ enables Access). manifest-schema-validate warn-on-missing-credentials-placeholder becomes fail with a fixture-setup pointer. Tunnel symbolic-anchor ruling (AC-tunnel-*) resolved and recorded in the PR body per brief C4.",
+  "dependsOnFbsIds": []
+}

package/rcf/fbs/fbs-174.json

@@ -0,0 +1,17 @@
+{
+  "createdAt": "2026-09-08T12:22:33.140Z",
+  "updatedAt": "2026-09-08T14:04:48.623Z",
+  "acIds": [
+    "AC-15401-1",
+    "AC-15401-2",
+    "AC-15401-3"
+  ],
+  "fbsId": "FBS-174",
+  "prdId": "PRD-001",
+  "bsId": "BS-001",
+  "buildOrder": 69,
+  "executionStatus": "notStarted",
+  "title": "H-2 cross-cutting probe hygiene: SIMULATE_ branches moved out of shipped probe bodies into fixture-side h2-cf-platform-probe-integrity shims across the four blueprints; committed fail envelope removed and shipped-code pass envelopes committed; probe comments name test doubles honestly; new h2-cf-platform-probe-integrity anatomy test asserts SIMULATE_ purity, envelope hygiene and marker honesty",
+  "summary": "H-2 cross-cutting probe hygiene: SIMULATE_ branches moved out of the shipped probe bodies on the four Cloudflare-platform blueprints (kv: cache-aside-hit-then-miss, event-secrecy; DO: sole-reader-scan, storage-round-trip, websocket-hub-broadcast) into fixture-side shim modules under packages/rcf-lite/test/fixtures/cf-platform/ and .../cf-edge/ whose file names carry the h2-cf-platform-probe-integrity slug prefix (short form h2-cf). Delete the committed fail envelope at .rcf/reports/blueprints/platform-cloudflare-kv/event-secrecy.json and commit a shipped-code pass envelope in its place; regenerate the other kv envelopes and commit shipped-code pass envelopes for the DO/queue/tunnel probes. Rework or adjudicate probe comments flagged by stage-1 marker rows (kv fake clock; DO fake state, fake WebSocket pair; DO probe-utils lines 73 and 75; kv not-yet elicit gating). Add a new h2-cf-platform-probe-integrity anatomy test at packages/rcf-lite/test/blueprint/h2-cf-platform-probe-integrity.test.js that greps the four probe trees for SIMULATE_ (must be zero), walks committed envelopes for fail/warn aggregateVerdict (must be zero), and asserts marker rewording.",
+  "dependsOnFbsIds": []
+}

package/rcf/requirements/req-140.json

@@ -0,0 +1,149 @@
+{
+  "createdAt": "2026-09-08T09:02:25.166Z",
+  "updatedAt": "2026-09-08T09:02:37.052Z",
+  "description": "The object-storage-s3 blueprint gains a Hetzner Object Storage provider value under its shipped v1.0.0 S3-API facade contract. The delta adds an endpoint-shape helper hetzner-endpoint.mjs composing the vendor-documented pattern <bucket>.<location>.your-objectstorage.com from an elicited bucket and location (fsn1 fal, hel1 hel, nbg1 nur per the Hetzner storage overview); a new probe hetzner-object-storage-round-trip.mjs drives put/get/delete against the composed endpoint with accountBound true gated on CI_HAS_HETZNER_OBJECT_STORAGE (records accountBoundSkipped when unset per spec section 3.5); one blueprint-owned REQ (object-storage-s3-REQ-101) and one blueprint-owned US (object-storage-s3-US-28110) anchor the AC AC-28110-1; one blueprint TAC (TAC-2904-object-storage-s3-hetzner-endpoint-helper) formalises the helper contract; one blueprint ADR (ADR-2905-object-storage-s3-hetzner-object-storage-provider, scope local) documents the Hetzner provider value alongside R2, AWS, MinIO with standardsTraceClause Hetzner Object Storage S3 compatibility documented endpoint shape. The existing MinIO local emulator round-trip and R2 real-account smoke stay byte-identical; blueprint bumps 1.0.0 to 1.1.0; rcf-lite package version does NOT bump (spec 8). Chain: HQ round-7 follow-up per HQ chain-block ruling 2026-09-08 (adapter block REQ-140..144, TS-170..174, FBS-160..164, CN-500..509). Section 5.4 of hetzner-round-7-spec-2026-09-07.",
+  "reqId": "REQ-140",
+  "prdId": "PRD-001",
+  "title": "Adapter object-storage-s3 v1.1.0 Hetzner Object Storage: endpoint-shape helper composes <bucket>.<location>.your-objectstorage.com per Hetzner storage overview; delta contributions add hetzner-object-storage-round-trip probe (accountBound gated on CI_HAS_HETZNER_OBJECT_STORAGE); MinIO and R2 paths unchanged",
+  "category": "functional",
+  "domain": "functional",
+  "priority": "must",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [
+      "webUi",
+      "httpApi",
+      "persistence"
+    ],
+    "reason": "keyword-scan",
+    "classifiedAt": "2026-09-08T09:02:25.212Z",
+    "signals": [
+      {
+        "source": "title",
+        "shape": "persistence",
+        "match": "storage"
+      },
+      {
+        "source": "title",
+        "shape": "persistence",
+        "match": "Storage"
+      },
+      {
+        "source": "title",
+        "shape": "httpApi",
+        "match": "endpoint"
+      },
+      {
+        "source": "title",
+        "shape": "persistence",
+        "match": "storage"
+      },
+      {
+        "source": "title",
+        "shape": "persistence",
+        "match": "storage"
+      },
+      {
+        "source": "description",
+        "shape": "persistence",
+        "match": "storage"
+      },
+      {
+        "source": "description",
+        "shape": "persistence",
+        "match": "Storage"
+      },
+      {
+        "source": "description",
+        "shape": "httpApi",
+        "match": "API"
+      },
+      {
+        "source": "description",
+        "shape": "httpApi",
+        "match": "endpoint"
+      },
+      {
+        "source": "description",
+        "shape": "httpApi",
+        "match": "endpoint"
+      },
+      {
+        "source": "description",
+        "shape": "persistence",
+        "match": "storage"
+      },
+      {
+        "source": "description",
+        "shape": "persistence",
+        "match": "storage"
+      },
+      {
+        "source": "description",
+        "shape": "httpApi",
+        "match": "put"
+      },
+      {
+        "source": "description",
+        "shape": "httpApi",
+        "match": "get"
+      },
+      {
+        "source": "description",
+        "shape": "httpApi",
+        "match": "delete"
+      },
+      {
+        "source": "description",
+        "shape": "httpApi",
+        "match": "endpoint"
+      },
+      {
+        "source": "description",
+        "shape": "persistence",
+        "match": "storage"
+      },
+      {
+        "source": "description",
+        "shape": "persistence",
+        "match": "storage"
+      },
+      {
+        "source": "description",
+        "shape": "persistence",
+        "match": "storage"
+      },
+      {
+        "source": "description",
+        "shape": "httpApi",
+        "match": "endpoint"
+      },
+      {
+        "source": "description",
+        "shape": "webUi",
+        "match": "form"
+      },
+      {
+        "source": "description",
+        "shape": "persistence",
+        "match": "storage"
+      },
+      {
+        "source": "description",
+        "shape": "persistence",
+        "match": "storage"
+      },
+      {
+        "source": "description",
+        "shape": "persistence",
+        "match": "Storage"
+      },
+      {
+        "source": "description",
+        "shape": "httpApi",
+        "match": "endpoint"
+      }
+    ]
+  }
+}

package/rcf/requirements/req-145.json

@@ -0,0 +1,53 @@
+{
+  "createdAt": "2026-09-08T10:50:11.871Z",
+  "updatedAt": "2026-09-08T10:50:27.769Z",
+  "description": "H-1 patch train against deploy-hetzner-server 1.0.0 shipped in rcf-lite 0.25.0 (real-account gate d-2026-09-08-010 report). Nine defects; every real-account probe throws before writing the scratch id file so destroy cannot tear the server down. This REQ adds the standing requirement that mocked probes for deploy-hetzner-server consume the same rendered cloud-init user-data the real path consumes (renderer writes the file; mock and real path both read it) and that the rendered user-data carries a real ssh public-key line for the deploy user plus NOPASSWD sudo for that user; that provision.mjs projects snake_case hcloud fields; that destroy.mjs and sweep-orphans.mjs never pass --output json to a delete verb (accepts arrays or objects); that snapshot-verb.mjs shells hcloud server create-image --type snapshot; that ssh baseline checks poll ssh readiness before firing and shell NOPASSWD sudo; and that the manifest ssh-key name is overridable via RCF_LITE_CI_SSH_KEY_NAME. Domain functional. Chain: HQ hardening block H-1 per HQ chain-block ruling 2026-09-08 (REQ-145..149 / TS-175..179 / FBS-165..169 / CN-510..519). Blueprint version 1.0.0 to 1.0.1; every existing contribution id byte-identical.",
+  "reqId": "REQ-145",
+  "prdId": "PRD-001",
+  "title": "Hardening H-1: throwaway-server fixture real-path fidelity for deploy-hetzner-server; provision reads hcloud snake_case; renderer inlines ssh key material; destroy/sweep drop --output json; snapshot verb uses hcloud server create-image; ssh baseline waits for cloud-init and runs under NOPASSWD deploy; sshKeyIds override via RCF_LITE_CI_SSH_KEY_NAME; mock consumes the same rendered cloud-init",
+  "category": "functional",
+  "domain": "functional",
+  "priority": "must",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [
+      "webUi",
+      "httpApi"
+    ],
+    "reason": "keyword-scan",
+    "classifiedAt": "2026-09-08T10:50:11.918Z",
+    "signals": [
+      {
+        "source": "title",
+        "shape": "webUi",
+        "match": "render"
+      },
+      {
+        "source": "title",
+        "shape": "webUi",
+        "match": "rendered"
+      },
+      {
+        "source": "description",
+        "shape": "webUi",
+        "match": "rendered"
+      },
+      {
+        "source": "description",
+        "shape": "webUi",
+        "match": "render"
+      },
+      {
+        "source": "description",
+        "shape": "webUi",
+        "match": "rendered"
+      },
+      {
+        "source": "description",
+        "shape": "httpApi",
+        "match": "delete"
+      }
+    ]
+  }
+}

package/rcf/requirements/req-150.json

@@ -0,0 +1,20 @@
+{
+  "createdAt": "2026-09-08T12:16:28.007Z",
+  "updatedAt": "2026-09-08T12:16:28.158Z",
+  "description": "The rcf-lite platform-cloudflare-kv blueprint ships eight approved user stories (US-31101..US-31108) with nine ACs (AC-31101-1, AC-31102-1, AC-31103-1, AC-31103-2, AC-31104-1, AC-31105-1, AC-31106-1, AC-31107-1, AC-31108-1). Its five contributed probes and the README still anchor the defunct AC-5001..AC-5401 id band that never became chain rows on this repo. This train re-anchors every probe result and the README chain-slice pointers to the shipped AC-31xxx band per Dave ruling 4 (2026-09-08 relay 582c2bca): do NOT resurrect the AC-5xxx stories, move the probes to the shipped band. Every one of the nine shipped kv ACs must appear as an anchor (primary or additional result) on at least one probe with a runtime observable; the two ACs no shipped probe currently covers (AC-31102-1 sole-reader grep, AC-31107-1 whitelist-only lifecycle event scan) are added as additional results on facade-round-trip and event-secrecy per the dispatch addendum. Anatomy-test assertions move with the re-anchor per dispatch addendum ruling 1. No capability change; 0.25.x patch scope; runtime surface unchanged.",
+  "category": "functional",
+  "domain": "functional",
+  "priority": "must",
+  "reqId": "REQ-150",
+  "prdId": "PRD-001",
+  "title": "H-2 kv re-anchor and observability: five kv probes and the README re-anchor from AC-5xxx to the shipped AC-31xxx band; every shipped kv AC gains a runtime observable",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [
+      "none"
+    ],
+    "reason": "keyword-scan",
+    "classifiedAt": "2026-09-08T12:16:28.156Z"
+  }
+}