rcf-lite 0.25.0 → 0.26.0

package/rcf/requirements/req-151.json

@@ -0,0 +1,85 @@
+{
+  "createdAt": "2026-09-08T12:16:28.590Z",
+  "updatedAt": "2026-09-08T12:16:28.726Z",
+  "description": "The rcf-lite platform-cloudflare-durable-objects blueprint ships thirteen ACs (AC-33101-1..AC-33113-1); eight probes anchor AC-33101, 33102, 33103, 33104, 33105, 33107, 33112, 33113, leaving AC-33106-1, AC-33108-1, AC-33109-1, AC-33110-1, AC-33111-1 unbound. real-account-storage-smoke.mjs currently returns pass on credential readiness alone. This train replaces the credential-readiness pass-stub with a real storage round-trip driver: when CI_HAS_CLOUDFLARE_ACCOUNT is set with CF_ACCOUNT_ID, CF_DO_NAMESPACE_ID (or the binding config the driver needs) and CF_API_TOKEN, the probe drives an HTTP round trip against a deployed Worker route that opens the DO facade, writes a fixture key, reads it back, asserts the returned bytes equal the written value. Local proof against miniflare or wrangler dev via the existing wrangler-seam. Env-absent branch keeps the section 3.5 pass-with-skip shape; a pass must never again be reachable from credential presence alone. The five unbound ACs are bound as additional-result anchors on the existing wrangler-seam, storage-round-trip and concurrent-increment probes (or a new probe body inside existing capability if none carries the observable honestly).",
+  "category": "functional",
+  "domain": "functional",
+  "priority": "must",
+  "reqId": "REQ-151",
+  "prdId": "PRD-001",
+  "title": "H-2 DO storage round-trip driver and anchor coverage: real-account-storage-smoke drives a byte-equal put/get through a deployed Worker (or wrangler-dev locally); five previously-unbound DO ACs bound as anchors on existing probes",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [
+      "webUi",
+      "httpApi",
+      "auth",
+      "persistence"
+    ],
+    "reason": "keyword-scan",
+    "classifiedAt": "2026-09-08T12:16:28.724Z",
+    "signals": [
+      {
+        "source": "title",
+        "shape": "persistence",
+        "match": "storage"
+      },
+      {
+        "source": "title",
+        "shape": "persistence",
+        "match": "storage"
+      },
+      {
+        "source": "title",
+        "shape": "httpApi",
+        "match": "put"
+      },
+      {
+        "source": "title",
+        "shape": "httpApi",
+        "match": "get"
+      },
+      {
+        "source": "description",
+        "shape": "persistence",
+        "match": "durable"
+      },
+      {
+        "source": "description",
+        "shape": "persistence",
+        "match": "storage"
+      },
+      {
+        "source": "description",
+        "shape": "auth",
+        "match": "credential"
+      },
+      {
+        "source": "description",
+        "shape": "auth",
+        "match": "credential"
+      },
+      {
+        "source": "description",
+        "shape": "persistence",
+        "match": "storage"
+      },
+      {
+        "source": "description",
+        "shape": "webUi",
+        "match": "route"
+      },
+      {
+        "source": "description",
+        "shape": "auth",
+        "match": "credential"
+      },
+      {
+        "source": "description",
+        "shape": "persistence",
+        "match": "storage"
+      }
+    ]
+  }
+}

package/rcf/requirements/req-152.json

@@ -0,0 +1,20 @@
+{
+  "createdAt": "2026-09-08T12:16:29.086Z",
+  "updatedAt": "2026-09-08T12:16:29.220Z",
+  "description": "The rcf-lite messaging-queue-cloudflare blueprint's real-account-concurrency-smoke.mjs returns verdict pass with accountBoundSkipped true on the account-set branch (the wrangler dev --remote path is unsupported for Queues, so a real-account run must ride a deployed Worker that binds the queue). This train replaces that pass-stub with a real concurrency driver: the account-set branch publishes 500 messages through the producer facade wired to a live Queues binding on a deployed Worker (queue name and binding parameterised via env; HQ supplies values at gate time, canonical queue rcf-lite-ci-queue-smoke) and asserts concurrent processing up to the documented push-invocation cap. Local proof against miniflare or wrangler dev (local queue simulation). The env-absent branch keeps pass-with-skip. The documented Cloudflare Queues limits URL is re-verified 200 at merge time and logged in the PR provenance.",
+  "category": "functional",
+  "domain": "functional",
+  "priority": "must",
+  "reqId": "REQ-152",
+  "prdId": "PRD-001",
+  "title": "H-2 queue real concurrency driver: real-account-concurrency-smoke publishes 500 messages through the producer facade against a live Queues binding on a deployed Worker; concurrent processing asserted against the documented push-invocation cap",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [
+      "none"
+    ],
+    "reason": "keyword-scan",
+    "classifiedAt": "2026-09-08T12:16:29.218Z"
+  }
+}

package/rcf/requirements/req-153.json

@@ -0,0 +1,59 @@
+{
+  "createdAt": "2026-09-08T12:16:29.584Z",
+  "updatedAt": "2026-09-08T12:16:29.719Z",
+  "description": "The rcf-lite edge-cloudflare-tunnel blueprint's two real-account probes return warn when the env vars ARE set (account-bound path present but not exercised) and manifest-schema-validate warns on a missing credentials placeholder. This train replaces both warn-on-env stubs with real drivers and converts the placeholder to a fail. real-account-connector-healthy: with both CI_HAS_CLOUDFLARE_ACCOUNT and CI_HAS_HETZNER_ACCOUNT set, provision the throwaway server through the T-1 hetzner fixture surface, run cloudflared tunnel info <name> through a cloudflared control shim, assert healthy connector count, capture the tunnelConnectorUp event. Consume the hetzner fixture as-is; its defects are H-1 scope at HQ; if the fixture path fails locally the driver fails with a pointer naming the fixture step, never warn. real-account-tunnel-hostname-routes: undici fetch driver for the public-hostname sub-case activated on CI_HAS_CLOUDFLARE_ACCOUNT; two-identity JWT driver for the access-gated sub-case activated only when CI_HAS_CLOUDFLARE_ACCESS is ALSO set (HQ note: Access is not enabled on the HQ account, so the AUD sub-case stays pass-with-skip until HQ enables Access). Env-absent branch keeps pass-with-skip; a pass must never again be reachable from account-flag presence alone. manifest-schema-validate.mjs missing-credentials-placeholder becomes FAIL with a fixture-setup pointer.",
+  "category": "functional",
+  "domain": "functional",
+  "priority": "must",
+  "reqId": "REQ-153",
+  "prdId": "PRD-001",
+  "title": "H-2 tunnel real drivers: connector-healthy runs cloudflared tunnel info against the throwaway hetzner server; hostname-routes drives undici and (when Access is enabled) a two-identity JWT probe; manifest-schema-validate placeholder becomes a fail-with-pointer",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [
+      "webUi",
+      "auth",
+      "persistence"
+    ],
+    "reason": "keyword-scan",
+    "classifiedAt": "2026-09-08T12:16:29.717Z",
+    "signals": [
+      {
+        "source": "title",
+        "shape": "webUi",
+        "match": "route"
+      },
+      {
+        "source": "title",
+        "shape": "persistence",
+        "match": "schema"
+      },
+      {
+        "source": "description",
+        "shape": "persistence",
+        "match": "schema"
+      },
+      {
+        "source": "description",
+        "shape": "auth",
+        "match": "credential"
+      },
+      {
+        "source": "description",
+        "shape": "webUi",
+        "match": "route"
+      },
+      {
+        "source": "description",
+        "shape": "persistence",
+        "match": "schema"
+      },
+      {
+        "source": "description",
+        "shape": "auth",
+        "match": "credential"
+      }
+    ]
+  }
+}

package/rcf/requirements/req-154.json

@@ -0,0 +1,44 @@
+{
+  "createdAt": "2026-09-08T12:16:30.083Z",
+  "updatedAt": "2026-09-08T12:16:30.218Z",
+  "description": "The four Cloudflare-platform blueprints (platform-cloudflare-kv, platform-cloudflare-durable-objects, messaging-queue-cloudflare, edge-cloudflare-tunnel) carry mutation-purity, envelope-hygiene and marker-wording defects surfaced by stage-2 semantic and stage-1 mechanical passes: SIMULATE_ env reads in probe bodies (cache-aside-hit-then-miss, event-secrecy, sole-reader-scan, storage-round-trip, websocket-hub-broadcast); a committed fail envelope at .rcf/reports/blueprints/platform-cloudflare-kv/event-secrecy.json; comments labelling local doubles as fake state / fake WebSocket pair / fake clock in ways the stage-1 marker sweep flagged. This train moves every probe-body SIMULATE_ branch into a fixture-side shim under packages/rcf-lite/test/fixtures/cf-platform/ or .../cf-edge/ (new shim files carry the h2-cf-platform-probe-integrity slug prefix, short form h2-cf acceptable), deletes the committed fail envelope and commits a shipped-code pass envelope in its place, regenerates the other kv envelopes so committed envelopes reflect the re-anchored shipped-code runs, and reworks probe comments to name the local test doubles honestly (or records adjudicated-acceptable with reason in the PR body). No capability change; 0.25.x patch scope.",
+  "category": "functional",
+  "domain": "functional",
+  "priority": "must",
+  "reqId": "REQ-154",
+  "prdId": "PRD-001",
+  "title": "H-2 cross-cutting probe hygiene: SIMULATE_ branches out of probe bodies into fixture shims; no fail envelope committed; probe comments name test doubles honestly",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [
+      "webUi",
+      "httpApi",
+      "persistence"
+    ],
+    "reason": "keyword-scan",
+    "classifiedAt": "2026-09-08T12:16:30.216Z",
+    "signals": [
+      {
+        "source": "description",
+        "shape": "persistence",
+        "match": "durable"
+      },
+      {
+        "source": "description",
+        "shape": "persistence",
+        "match": "storage"
+      },
+      {
+        "source": "description",
+        "shape": "webUi",
+        "match": "form"
+      },
+      {
+        "source": "description",
+        "shape": "httpApi",
+        "match": "delete"
+      }
+    ]
+  }
+}

package/rcf/test-suites/ts-071.json

@@ -1,6 +1,6 @@
 {
   "createdAt": "2026-09-06T17:50:13.712Z",
-  "updatedAt": "2026-09-06T17:51:32.845Z",
+  "updatedAt": "2026-09-08T09:26:29.965Z",
   "purpose": "Cover AC-4101-1..6 via unit tests over the shipped object-storage-s3 blueprint shape (contribution count, capabilities, suggestedCompanions, ADR standardsTraceClause), applies-clean-with-secrets and refuses-without behaviour, six Node-only probe module contract with anchorAcId cross-check, induced-failure switch documentation on the fixture README, and shelf-doc consistency (section 6a table row for objectStorage, shelf-wide docs/topics.md row for object-storage-s3 at 28101-28899 / 29xx).",
   "testLevel": "unit",
   "acIds": [
@@ -20,7 +20,7 @@
       "acId": "AC-4101-1",
       "description": "Cover AC-4101-1 via anatomy test",
       "status": "pending",
-      "testPointer": "test/blueprint/object-storage-s3-anatomy.test.js::blueprint.json declares 21 contributions with capabilities objectStorage, suggestedCompanions logging and errorHandling, and standardsTraceClause on every ADR entry (TC-071-blueprint-json-shape)"
+      "testPointer": "test/blueprint/object-storage-s3-anatomy.test.js::blueprint.json declares 25 contributions at v1.1.0 with capabilities objectStorage, suggestedCompanions logging and errorHandling, and standardsTraceClause on every ADR entry including the Hetzner Object Storage provider entry (TC-071-blueprint-json-shape)"
     },
     {
       "id": "TC-071-applies-clean-with-secrets",

package/rcf/test-suites/ts-086.json

@@ -1,6 +1,6 @@
 {
   "createdAt": "2026-09-07T10:20:32.919Z",
-  "updatedAt": "2026-09-07T10:21:02.065Z",
+  "updatedAt": "2026-09-08T15:28:06.407Z",
   "purpose": "Cover AC-5302-1 via event-secrecy probe with two-layer assertions and a mutation-run under SIMULATE_PII_LEAK",
   "testLevel": "unit",
   "acIds": [
@@ -15,7 +15,7 @@
       "acId": "AC-5302-1",
       "description": "Cover AC-5302-1 via event-secrecy probe: no body bytes / PII / user id reach the sink even under a mutation-run",
       "status": "pending",
-      "testPointer": "test/blueprint/platform-cloudflare-kv-anatomy.test.js::event-secrecy probe passes on PII fixture and fails under SIMULATE_PII_LEAK (TC-086-event-secrecy)"
+      "testPointer": "test/blueprint/platform-cloudflare-kv-anatomy.test.js::event-secrecy probe passes on PII fixture and fails under fixture-side SIMULATE_PII_LEAK (TC-086-event-secrecy)"
     }
   ],
   "status": "draft"

package/rcf/test-suites/ts-170.json

@@ -0,0 +1,22 @@
+{
+  "createdAt": "2026-09-08T09:03:22.340Z",
+  "updatedAt": "2026-09-08T09:03:32.202Z",
+  "purpose": "Cover the adapter chain AC via the shipped anatomy test at test/blueprint/object-storage-s3-hetzner-anatomy.test.js and via the new probe module hetzner-object-storage-round-trip.mjs driven from the extended infra-s3-and-queue fixture (accountBoundSkipped path without CI_HAS_HETZNER_OBJECT_STORAGE, endpoint-composition mutation via SIMULATE_HETZNER_ENDPOINT_MISSHAPEN)",
+  "testLevel": "integration",
+  "acIds": [
+    "AC-14001-1"
+  ],
+  "id": "TS-170",
+  "usId": "US-14001",
+  "title": "Adapter object-storage-s3 v1.1.0 Hetzner Object Storage: probe module anatomy and fixture-side helper contract",
+  "testCases": [
+    {
+      "id": "TC-170-hetzner-endpoint-round-trip-and-skipped-shape",
+      "acId": "AC-14001-1",
+      "description": "Cover AC-14001-1 via anatomy test: hetzner-endpoint helper composes the vendor pattern <bucket>.<location>.your-objectstorage.com from an elicited bucket and location; the run-hetzner-object-storage-round-trip probe records accountBoundSkipped true and aggregateVerdict pass without CI_HAS_HETZNER_OBJECT_STORAGE; the extended fixture ships hetzner-endpoint.mjs and run-hetzner-object-storage-round-trip.mjs alongside the shipped MinIO and R2 assets; SIMULATE_HETZNER_ENDPOINT_MISSHAPEN true composes an invalid endpoint via the fixture-side shim and the probe FAILS naming the missing subdomain",
+      "status": "pending",
+      "testPointer": "test/blueprint/object-storage-s3-hetzner-anatomy.test.js::adapter object-storage-s3 v1.1.0 hetzner AC-14001-1 endpoint round-trip and skipped shape (TC-170-hetzner-endpoint-round-trip-and-skipped-shape)"
+    }
+  ],
+  "status": "draft"
+}

package/rcf/test-suites/ts-175.json

@@ -0,0 +1,22 @@
+{
+  "createdAt": "2026-09-08T10:51:19.406Z",
+  "updatedAt": "2026-09-08T10:51:55.354Z",
+  "purpose": "Anchor AC-14501-1 via the shipped anatomy test: the hcloud-dry-run-mock probe reads the rendered cloud-init user-data written by the fixture renderer and asserts (a) at least one ssh-ed25519 or ssh-rsa public-key line is present under the deploy user and (b) a write_files or sudoers.d fragment grants NOPASSWD to that user; the probe FAILS on either missing marker. Purity: the three T-1 mocked probes no longer read SIMULATE_ switches inside the probe body; those live in fixture-side shims and alter INPUT only.",
+  "testLevel": "integration",
+  "acIds": [
+    "AC-14501-1"
+  ],
+  "id": "TS-175",
+  "usId": "US-14501",
+  "title": "H-1 patch train verifiers for deploy-hetzner-server 1.0.1: hcloud-dry-run-mock consumes the same rendered cloud-init the real path consumes and asserts an ssh public-key line for the deploy user plus a NOPASSWD sudoers.d entry; ssh baseline check module gains an unmocked purity assertion that no SIMULATE_ branch remains in the probes for T-1",
+  "testCases": [
+    {
+      "id": "TC-175-mock-consumes-rendered-file-and-probe-purity",
+      "acId": "AC-14501-1",
+      "description": "Render the shipped cloud-init.yaml.tmpl against ci-throwaway.json via the fixture renderer with an ssh key material substitution and NOPASSWD sudoers.d fragment for the deploy user. Assert the rendered file appears at hetzner/servers/rendered/ci-throwaway.cloud-init.yaml with at least one ssh-ed25519 or ssh-rsa authorized-keys line under the deploy user and a NOPASSWD directive naming that user. Run the hcloud-dry-run-mock probe: assert the mock reads back that same rendered file and returns pass. Also assert none of the three T-1 mocked probes (cloud-init-render-lint, hcloud-dry-run-mock, manifest-schema-validate) contain the token SIMULATE_ inside the probe body; the switches live only in the fixture-side shims. Anchors AC-14501-1.",
+      "status": "pending",
+      "testPointer": "test/blueprint/deploy-hetzner-server-anatomy.test.js::H-1 deploy-hetzner-server AC-14501-1 mock consumes the same rendered cloud-init and probes carry no SIMULATE reads (TC-175-mock-consumes-rendered-file-and-probe-purity)"
+    }
+  ],
+  "status": "draft"
+}

package/rcf/test-suites/ts-180.json

@@ -0,0 +1,30 @@
+{
+  "createdAt": "2026-09-08T12:20:54.397Z",
+  "updatedAt": "2026-09-08T12:21:44.136Z",
+  "purpose": "Cover AC-15001-1 (no AC-5xxx string survives in the kv blueprint tree) and AC-15001-2 (every shipped kv AC appears as an anchor on at least one probe result) via the kv-anatomy test file whose assertions moved with the re-anchor per dispatch addendum ruling 1",
+  "testLevel": "integration",
+  "acIds": [
+    "AC-15001-1",
+    "AC-15001-2"
+  ],
+  "id": "TS-180",
+  "usId": "US-15001",
+  "title": "H-2 kv re-anchor: probes cite shipped AC-31xxx band, README pointers align, every shipped kv AC covered by a probe with a runtime observable",
+  "testCases": [
+    {
+      "id": "TC-180-no-ac-5xxx-after-re-anchor",
+      "acId": "AC-15001-1",
+      "description": "Cover AC-15001-1 via kv-anatomy test: grep for AC-5 across the kv blueprint tree returns zero hits after H-2 re-anchor; every anchorAcId string in the five kv probes cites AC-31xxx; the kv README chain-slice pointer paragraph names US-31101..US-31108 and no AC-5xxx string remains.",
+      "status": "pending",
+      "testPointer": "test/blueprint/platform-cloudflare-kv-anatomy.test.js::H-2 kv AC-15001-1 no AC-5xxx string survives on the kv blueprint tree after re-anchor"
+    },
+    {
+      "id": "TC-180-shipped-kv-ac-coverage-union",
+      "acId": "AC-15001-2",
+      "description": "Cover AC-15001-2 via kv-anatomy test: each of the nine shipped kv ACs (AC-31101-1, AC-31102-1, AC-31103-1, AC-31103-2, AC-31104-1, AC-31105-1, AC-31106-1, AC-31107-1, AC-31108-1) appears in the union of shipped probe results and each cited result is pass; AC-31102-1 is observed via the runtime env.CACHE-grep result on facade-round-trip; AC-31107-1 is observed via the whitelist-scan result on event-secrecy.",
+      "status": "pending",
+      "testPointer": "test/blueprint/platform-cloudflare-kv-anatomy.test.js::H-2 kv AC-15001-2 every shipped kv AC appears in the union of probe results with pass verdict"
+    }
+  ],
+  "status": "draft"
+}

package/rcf/test-suites/ts-181.json

@@ -0,0 +1,30 @@
+{
+  "createdAt": "2026-09-08T12:20:54.783Z",
+  "updatedAt": "2026-09-08T12:21:44.894Z",
+  "purpose": "Cover AC-15101-1 (real HTTP round-trip drives DO facade byte-equal; no pass on credential-presence alone) and AC-15101-2 (all thirteen shipped DO ACs bound as probe anchors) via the DO anatomy test and via the storage-round-trip probe module",
+  "testLevel": "integration",
+  "acIds": [
+    "AC-15101-1",
+    "AC-15101-2"
+  ],
+  "id": "TS-181",
+  "usId": "US-15101",
+  "title": "H-2 DO real storage driver and anchor coverage: real-account-storage-smoke drives a real round-trip against a deployed Worker; all thirteen DO ACs bound as probe anchors",
+  "testCases": [
+    {
+      "id": "TC-181-do-real-storage-round-trip-driver",
+      "acId": "AC-15101-1",
+      "description": "Cover AC-15101-1 via DO anatomy test: real-account-storage-smoke drives a byte-equal HTTP round trip against a deployed Worker route on the account-set branch (or local miniflare/wrangler-dev via wrangler-seam); pass is unreachable from credential-presence alone; the fixture-side mutation switch (returns wrong bytes on read) flips the probe to aggregateVerdict fail with observed and expected bytes named.",
+      "status": "pending",
+      "testPointer": "test/blueprint/platform-cloudflare-durable-objects-anatomy.test.js::H-2 DO AC-15101-1 real-account-storage-smoke drives byte-equal round-trip via deployed Worker or wrangler-dev"
+    },
+    {
+      "id": "TC-181-do-thirteen-ac-coverage-union",
+      "acId": "AC-15101-2",
+      "description": "Cover AC-15101-2 via DO anatomy test: each of the thirteen shipped DO ACs (AC-33101-1..AC-33113-1) appears in the union of shipped DO probe results; the five previously-unbound DO ACs (AC-33106-1, AC-33108-1, AC-33109-1, AC-33110-1, AC-33111-1) are bound as additional-result anchors on the wrangler-seam, storage-round-trip and concurrent-increment probes with a runtime observable.",
+      "status": "pending",
+      "testPointer": "test/blueprint/platform-cloudflare-durable-objects-anatomy.test.js::H-2 DO AC-15101-2 all thirteen shipped DO ACs appear in the union of probe results with pass verdict"
+    }
+  ],
+  "status": "draft"
+}

package/rcf/test-suites/ts-182.json

@@ -0,0 +1,22 @@
+{
+  "createdAt": "2026-09-08T12:20:55.203Z",
+  "updatedAt": "2026-09-08T12:21:45.254Z",
+  "purpose": "Cover AC-15201-1 (real 500-message concurrency drive against a live Queues binding on a deployed Worker; no accountBoundSkipped on the account-set branch) via the queue anatomy test and the real-account-concurrency-smoke probe",
+  "testLevel": "integration",
+  "acIds": [
+    "AC-15201-1"
+  ],
+  "id": "TS-182",
+  "usId": "US-15201",
+  "title": "H-2 queue real concurrency driver: real-account-concurrency-smoke publishes 500 messages against a live Queues binding and asserts concurrent processing",
+  "testCases": [
+    {
+      "id": "TC-182-queue-real-concurrency-500-msg",
+      "acId": "AC-15201-1",
+      "description": "Cover AC-15201-1 via queue anatomy test: real-account-concurrency-smoke publishes 500 messages through the producer facade against a live Queues binding on a deployed Worker (or local miniflare/wrangler-dev queue) and asserts observed max-in-flight consumers greater than one and not exceeding the documented push-invocation cap; accountBoundSkipped is never set on the account-set branch; the documented limits URL answered 200 at merge time.",
+      "status": "pending",
+      "testPointer": "test/blueprint/messaging-queue-cloudflare-anatomy.test.js::H-2 queue AC-15201-1 real-account-concurrency-smoke publishes 500 messages and asserts concurrent processing under cap"
+    }
+  ],
+  "status": "draft"
+}

package/rcf/test-suites/ts-183.json

@@ -0,0 +1,38 @@
+{
+  "createdAt": "2026-09-08T12:20:55.592Z",
+  "updatedAt": "2026-09-08T12:21:46.445Z",
+  "purpose": "Cover AC-15301-1 (connector-healthy provisions hetzner throwaway server and asserts healthy connector count), AC-15301-2 (hostname-routes drives undici and JWT sub-cases with pass-only via real driver evidence), and AC-15301-3 (manifest-schema-validate placeholder becomes fail-with-pointer) via the tunnel anatomy test and the three tunnel probes",
+  "testLevel": "integration",
+  "acIds": [
+    "AC-15301-1",
+    "AC-15301-2",
+    "AC-15301-3"
+  ],
+  "id": "TS-183",
+  "usId": "US-15301",
+  "title": "H-2 tunnel real drivers: connector-healthy runs cloudflared tunnel info against the throwaway hetzner host; hostname-routes drives undici and (with Access) a two-identity JWT probe; manifest-schema-validate placeholder becomes fail-with-pointer",
+  "testCases": [
+    {
+      "id": "TC-183-tunnel-connector-healthy-real-driver",
+      "acId": "AC-15301-1",
+      "description": "Cover AC-15301-1 via tunnel anatomy test: real-account-connector-healthy provisions the throwaway hetzner server via the T-1 hetzner fixture, brings a cloudflared connector up, runs cloudflared tunnel info <name> through a control shim, asserts healthy connector count is at least one, captures tunnelConnectorUp event; hetzner-fixture failure fails the driver with a fixture-step pointer, never warn.",
+      "status": "pending",
+      "testPointer": "test/blueprint/edge-cloudflare-tunnel-anatomy.test.js::H-2 tunnel AC-15301-1 real-account-connector-healthy asserts healthy connector count via cloudflared tunnel info"
+    },
+    {
+      "id": "TC-183-tunnel-hostname-routes-real-driver",
+      "acId": "AC-15301-2",
+      "description": "Cover AC-15301-2 via tunnel anatomy test: real-account-tunnel-hostname-routes drives undici for the public-hostname sub-case (pass on HTTP 200 with expected body signature); when CI_HAS_CLOUDFLARE_ACCESS is set, the two-identity JWT sub-case succeeds with JWT and is denied without; accountBoundSkipped is never set on the account-set branch; AUD sub-case stays pass-with-skip when Access is unset.",
+      "status": "pending",
+      "testPointer": "test/blueprint/edge-cloudflare-tunnel-anatomy.test.js::H-2 tunnel AC-15301-2 real-account-tunnel-hostname-routes drives undici and (with Access) two-identity JWT"
+    },
+    {
+      "id": "TC-183-manifest-schema-fail-with-pointer",
+      "acId": "AC-15301-3",
+      "description": "Cover AC-15301-3 via tunnel anatomy test: manifest-schema-validate returns aggregateVerdict fail (not warn) with a detail string naming the missing credentials placeholder file and the fixture-setup step that would create it; the warn-on-missing-credentials-placeholder branch is removed.",
+      "status": "pending",
+      "testPointer": "test/blueprint/edge-cloudflare-tunnel-anatomy.test.js::H-2 tunnel AC-15301-3 manifest-schema-validate fails with fixture-setup pointer when credentials placeholder is missing"
+    }
+  ],
+  "status": "draft"
+}

package/rcf/test-suites/ts-184.json

@@ -0,0 +1,38 @@
+{
+  "createdAt": "2026-09-08T12:20:55.987Z",
+  "updatedAt": "2026-09-08T12:21:47.637Z",
+  "purpose": "Cover AC-15401-1 (SIMULATE_ purity across the four Cloudflare-platform blueprints), AC-15401-2 (envelope hygiene: no fail/warn envelopes committed) and AC-15401-3 (probe comment honesty on the four blueprints) via a new h2-cf-platform-probe-integrity anatomy test that greps the shipped tree and reads the committed envelopes",
+  "testLevel": "integration",
+  "acIds": [
+    "AC-15401-1",
+    "AC-15401-2",
+    "AC-15401-3"
+  ],
+  "id": "TS-184",
+  "usId": "US-15401",
+  "title": "H-2 cross-cutting probe hygiene: no SIMULATE_ in shipped probes on the four blueprints; no fail envelope committed; probe comments name test doubles honestly",
+  "testCases": [
+    {
+      "id": "TC-184-simulate-purity-four-blueprints",
+      "acId": "AC-15401-1",
+      "description": "Cover AC-15401-1 via new h2-cf-platform-probe-integrity anatomy test: a recursive grep for the token SIMULATE_ across contributions/probes/*.mjs on the four Cloudflare-platform blueprints returns zero hits; every fixture shim under packages/rcf-lite/test/fixtures/cf-platform/ and .../cf-edge/ that carries a mutation switch has a file name prefixed h2-cf-platform-probe-integrity or h2-cf; FAIL tails from each moved switch are recorded in the PR provenance transcript at Group D close.",
+      "status": "pending",
+      "testPointer": "test/blueprint/h2-cf-platform-probe-integrity.test.js::H-2 hygiene AC-15401-1 SIMULATE_ purity across the four Cloudflare-platform probe trees"
+    },
+    {
+      "id": "TC-184-envelope-hygiene-four-blueprints",
+      "acId": "AC-15401-2",
+      "description": "Cover AC-15401-2 via new h2-cf-platform-probe-integrity anatomy test: every committed envelope under .rcf/reports/blueprints/{platform-cloudflare-kv, platform-cloudflare-durable-objects, messaging-queue-cloudflare, edge-cloudflare-tunnel}/ carries aggregateVerdict pass; the previously committed fail envelope at .rcf/reports/blueprints/platform-cloudflare-kv/event-secrecy.json is replaced with a shipped-code pass envelope.",
+      "status": "pending",
+      "testPointer": "test/blueprint/h2-cf-platform-probe-integrity.test.js::H-2 hygiene AC-15401-2 no fail or warn envelope committed under .rcf/reports on the four blueprints"
+    },
+    {
+      "id": "TC-184-marker-hygiene-four-blueprints",
+      "acId": "AC-15401-3",
+      "description": "Cover AC-15401-3 via new h2-cf-platform-probe-integrity anatomy test: every stage-1 marker-flagged probe comment or probe-utils comment on the four blueprints is either reworded to name the local test double honestly (in-memory KV driver realising the Workers KV binding shape; synthetic WebSocket pair; elicited deterministic clock; explicit follow-up work-item note in place of not-yet) or listed as adjudicated acceptable in the PR body's stage-1 adjudication table with a stated reason.",
+      "status": "pending",
+      "testPointer": "test/blueprint/h2-cf-platform-probe-integrity.test.js::H-2 hygiene AC-15401-3 probe comments name test doubles honestly on the four blueprints"
+    }
+  ],
+  "status": "draft"
+}

package/rcf/user-stories/us-14001.json

@@ -0,0 +1,21 @@
+{
+  "createdAt": "2026-09-08T09:02:48.558Z",
+  "updatedAt": "2026-09-08T09:05:33.736Z",
+  "description": "As a shelf consumer applying object-storage-s3 v1.1.0 on a Hetzner Object Storage bucket, I want an endpoint-shape helper that composes the vendor-documented endpoint pattern from an elicited bucket and location code, and a probe that proves the composed endpoint round-trips a byte-equal put/get/delete on either a real Hetzner Object Storage bucket (when CI_HAS_HETZNER_OBJECT_STORAGE is set) or records accountBoundSkipped true when not, so the R2 real-account smoke and the MinIO local-emulator flow both stay unaffected while the shelf gains a fourth provider value alongside R2, AWS, MinIO. Chain: HQ round-7 follow-up adapter block per HQ chain-block ruling 2026-09-08.",
+  "usId": "US-14001",
+  "prdId": "PRD-001",
+  "reqId": "REQ-140",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-follow-up adapter object-storage-s3 v1.1.0 Hetzner: endpoint-shape helper composes <bucket>.<location>.your-objectstorage.com; new probe hetzner-object-storage-round-trip drives put/get/delete against the composed endpoint on the extended fixture; accountBound gated on CI_HAS_HETZNER_OBJECT_STORAGE",
+  "asA": "shelf consumer applying object-storage-s3 v1.1.0 on a Hetzner Object Storage bucket (fsn1, hel1 or nbg1 location)",
+  "iWant": "an endpoint-shape helper that composes <bucket>.<location>.your-objectstorage.com from an elicited bucket and location per the Hetzner storage overview, plus a new Node-only probe hetzner-object-storage-round-trip.mjs driven from the extended infra-s3-and-queue fixture that either round-trips a byte-equal put/get/delete against a real Hetzner Object Storage bucket when CI_HAS_HETZNER_OBJECT_STORAGE is set or records accountBoundSkipped true when unset",
+  "soThat": "the shelf gains a fourth provider value alongside R2, AWS and MinIO with no runtime dependency added to the applying project, no facade re-shape, and no regression to the shipped MinIO local-emulator or R2 real-account paths",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-14001-1",
+      "description": "Given the extended fixture packages/rcf-lite/test/fixtures/infra-s3-and-queue/ carrying hetzner-endpoint.mjs and run-hetzner-object-storage-round-trip.mjs, when node blueprints/object-storage-s3/contributions/probes/run-hetzner-object-storage-round-trip.mjs runs, then either (a) with CI_HAS_HETZNER_OBJECT_STORAGE set alongside HETZNER_OBJECT_STORAGE_ACCESS_KEY_ID, HETZNER_OBJECT_STORAGE_SECRET_ACCESS_KEY, HETZNER_OBJECT_STORAGE_BUCKET and HETZNER_OBJECT_STORAGE_LOCATION the composed endpoint is https://<bucket>.<location>.your-objectstorage.com per the Hetzner storage overview and put/get/delete round-trips a byte-equal 1 KiB payload with teardown scrubbing the object; or (b) without CI_HAS_HETZNER_OBJECT_STORAGE the probe records accountBoundSkipped true and the aggregate flips to pass per spec section 3.5. The endpoint-shape helper is the sole composer of the vendor pattern; SIMULATE_HETZNER_ENDPOINT_MISSHAPEN true composes an invalid endpoint via the fixture-side shim (INPUT-side mutation) and the probe FAILS naming the missing subdomain. Anchors the label AC-hetznerObjectStorage-endpointRoundTrip on the blueprint side.",
+      "testable": true
+    }
+  ]
+}

package/rcf/user-stories/us-14501.json

@@ -0,0 +1,24 @@
+{
+  "createdAt": "2026-09-08T10:51:08.784Z",
+  "updatedAt": "2026-09-08T10:53:03.294Z",
+  "asA": "shelf consumer running the deploy-hetzner-server v1.0.1 real-account probes against a live Hetzner Cloud project (CI_HAS_HETZNER_ACCOUNT=true)",
+  "iWant": "the T-1 real-account probes to return aggregateVerdict pass without local patches: provision reads snake_case hcloud fields; the fixture renders the cloud-init user-data to a scratch path from the shipped template with resolved ssh public-key material and NOPASSWD sudo for the deploy user; provision, mock and destroy consume that same rendered file; destroy and sweep-orphans never pass --output json to a delete verb; the snapshot verb uses hcloud server create-image --type snapshot and matches by label; ssh baseline waits for cloud-init before firing; and the manifest ssh-key name is overridable via RCF_LITE_CI_SSH_KEY_NAME with the manifest value as default",
+  "soThat": "the mocked probes cannot pass while the real path fails on the same rendered artefact, throwaway servers never leak because destroy always succeeds, and the six baseline hardening blocks are observably present on the running server",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-14501-1",
+      "description": "Given the shared throwaway-server fixture at packages/rcf-lite/test/fixtures/hetzner-throwaway-server/ on the H-1 patch train, when node blueprints/deploy-hetzner-server/contributions/probes/run-real-account-throwaway-server-provision.mjs, run-real-account-cloud-init-hardened.mjs and run-real-account-snapshot-on-demand.mjs run against a live Hetzner Cloud project (CI_HAS_HETZNER_ACCOUNT=true, RCF_LITE_CI_SSH_KEY_NAME=dave-ed25519, HCLOUD_TOKEN from hq-estate/HETZNER_ACCOUNT_API_KEY), then (a) provision writes hetzner/servers/rendered/ci-throwaway.cloud-init.yaml by rendering the shipped cloud-init template with the ssh public-key material fetched via hcloud ssh-key describe --output json and a write_files sudoers.d fragment granting NOPASSWD to the deploy user; (b) provision reads s.public_net.ipv4.ip, s.datacenter.location.name, s.server_type.name (snake_case) off the hcloud server create --output json response and writes scratch/last-throwaway.json before returning; (c) hcloud-dry-run-mock.mjs reads the same rendered file back and asserts it carries at least one ssh-ed25519 or ssh-rsa line and a NOPASSWD directive naming the deploy user; (d) destroy.mjs and sweep-orphans.mjs never pass --output json to a hcloud <resource> delete verb and the tolerant JSON parser accepts arrays; (e) snapshot-verb.mjs shells hcloud server create-image --type snapshot --description <label> <id> and recovers the created id via hcloud image list --type=snapshot --output json by matching the serverName label; (f) ssh-baseline-check.mjs polls port 22 open plus a ssh true exec (bounded up to 6 minutes) before firing the six baseline checks, all six of which pass on the running server (sshKeyOnly, rootDisabled, ufwDefaultDeny, dockerUserChain, fail2banActive, unattendedUpgradesActive). Anchors the label AC-hetznerServer-realAccountFidelity.",
+      "testable": true
+    }
+  ],
+  "usId": "US-14501",
+  "prdId": "PRD-001",
+  "reqId": "REQ-145",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "H-1: deploy-hetzner-server 1.0.1 real-account probes return aggregateVerdict pass unpatched; fixture renders cloud-init with ssh public key material and NOPASSWD deploy user; mock consumes the same rendered file; destroy and sweep drop --output json on delete; snapshot uses hcloud server create-image --type snapshot; ssh baseline polls before firing; sshKeyIds override via RCF_LITE_CI_SSH_KEY_NAME",
+  "tacIds": [
+    "TAC-3801-deploy-hetzner-server-provisioner",
+    "TAC-3803-deploy-hetzner-server-cloud-init-template"
+  ]
+}

package/rcf/user-stories/us-15001.json

@@ -0,0 +1,26 @@
+{
+  "createdAt": "2026-09-08T12:17:33.807Z",
+  "updatedAt": "2026-09-08T12:19:24.742Z",
+  "asA": "rcf-lite maintainer applying platform-cloudflare-kv v1.0.0",
+  "iWant": "every kv probe result and the kv README to cite ACs from the shipped AC-31xxx band, and every one of the nine shipped kv ACs to appear as an anchor (primary or additional result) on at least one probe with a runtime observable",
+  "soThat": "the shipped kv probes count as evidence for the shipped kv ACs, no defunct AC-5xxx id survives on the kv blueprint, and traceability closes over the whole shipped kv surface",
+  "description": "As part of H-2 (Cloudflare-platform probe integrity), re-anchor every kv probe (facade-round-trip, list-with-prefix, cache-aside-hit-then-miss, event-secrecy, real-account-eventual-consistency-smoke), plus the kv README chain-slice pointers and the kv-anatomy test assertions, from AC-5xxx to the shipped AC-31xxx band per Dave ruling 4 (relay 582c2bca, 2026-09-08). The two ACs no shipped probe currently covers are added as additional results: AC-31102-1 (env.CACHE grep returns exactly src/kv-facade.mjs) becomes a runtime grep observable on facade-round-trip; AC-31107-1 (whitelist-only lifecycle events) becomes a whitelist-scan result on event-secrecy. Anatomy-test edits ride H-2 per dispatch addendum ruling 1. Nine ACs bound: 31101-1, 31102-1, 31103-1, 31103-2, 31104-1, 31105-1, 31106-1, 31107-1, 31108-1.",
+  "usId": "US-15001",
+  "prdId": "PRD-001",
+  "reqId": "REQ-150",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "H-2 kv re-anchor: every kv probe result cites AC-31xxx; every shipped kv AC gains a runtime observable through the existing five probes",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-15001-1",
+      "description": "A grep for AC-5 across blueprints/platform-cloudflare-kv/ (probes, README, changelog, guide, blueprint.json, .rcf/reports/blueprints/platform-cloudflare-kv/) returns zero hits. Every anchorAcId string in the five contributed kv probes (facade-round-trip, list-with-prefix, cache-aside-hit-then-miss, event-secrecy, real-account-eventual-consistency-smoke) and every AC id in the kv-anatomy test cite the shipped AC-31xxx band. The kv README chain-slice pointer paragraph names the shipped US-31101..US-31108 range and no AC-5xxx string remains.",
+      "testable": true
+    },
+    {
+      "id": "AC-15001-2",
+      "description": "Each of the nine shipped kv ACs (AC-31101-1, AC-31102-1, AC-31103-1, AC-31103-2, AC-31104-1, AC-31105-1, AC-31106-1, AC-31107-1, AC-31108-1) appears as an anchorAcId (primary or additional result) on at least one shipped kv probe result. AC-31102-1 is covered by a runtime env.CACHE-grep observable on facade-round-trip; AC-31107-1 is covered by a whitelist-scan observable on event-secrecy. A test in the kv-anatomy suite asserts each of the nine AC ids appears in the union of shipped probe results and each cited result is pass.",
+      "testable": true
+    }
+  ]
+}

package/rcf/user-stories/us-15101.json

@@ -0,0 +1,26 @@
+{
+  "createdAt": "2026-09-08T12:17:34.305Z",
+  "updatedAt": "2026-09-08T12:19:47.426Z",
+  "asA": "rcf-lite maintainer applying platform-cloudflare-durable-objects v1.0.0",
+  "iWant": "real-account-storage-smoke to drive a real HTTP round trip against a deployed Worker route that opens the DO facade, writes a fixture key and reads it back byte-equal (or record accountBoundSkipped when the account env is absent), and the five DO ACs currently unbound (AC-33106-1, AC-33108-1, AC-33109-1, AC-33110-1, AC-33111-1) to appear as additional-result anchors on the wrangler-seam, storage-round-trip and concurrent-increment probes",
+  "soThat": "the real-account run proves the DO facade actually round-trips a value on Cloudflare (not just that credentials are present), and all 13 shipped DO ACs are bound to a probe with a runtime observable",
+  "description": "Part of H-2. The credential-readiness pass-stub is replaced by a real driver: when CI_HAS_CLOUDFLARE_ACCOUNT is set with CF_ACCOUNT_ID, CF_DO_NAMESPACE_ID (or the binding config the driver needs) and CF_API_TOKEN, the probe drives an HTTP round trip against a deployed Worker route; the returned bytes must equal the written bytes for pass. Local proof via the existing wrangler-seam against miniflare or wrangler dev. Env-absent branch keeps section 3.5 pass-with-skip shape. A pass must never again be reachable from credential presence alone. The five unbound ACs are bound as additional-result anchors on existing probes; if any AC has no honest carrier a new probe body is added inside existing capability.",
+  "usId": "US-15101",
+  "prdId": "PRD-001",
+  "reqId": "REQ-151",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "H-2 DO real storage driver + anchor coverage: real-account-storage-smoke drives a byte-equal put/get round-trip against a deployed Worker; five previously-unbound DO ACs bound as additional-result anchors on existing probes",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-15101-1",
+      "description": "When CI_HAS_CLOUDFLARE_ACCOUNT is set with CF_ACCOUNT_ID, CF_DO_NAMESPACE_ID (or the DO binding config the driver needs) and CF_API_TOKEN, real-account-storage-smoke drives an HTTP round trip against a deployed Worker route that opens the DO facade, writes a fixture key with a random 1 KiB payload, reads it back, and asserts the returned bytes equal the written value (fail-with-detail otherwise, never pass on credential-presence). Local proof: the same driver path against miniflare or wrangler dev via the existing wrangler-seam. Env-absent branch keeps section 3.5 pass-with-skip. A mutation switch (moved to a fixture-side shim; not read from a probe body) that returns wrong bytes on read causes aggregateVerdict fail with the observed vs expected bytes named.",
+      "testable": true
+    },
+    {
+      "id": "AC-15101-2",
+      "description": "Each of the thirteen shipped DO ACs (AC-33101-1..AC-33113-1) appears as an anchorAcId (primary or additional result) on at least one shipped DO probe result. The five previously-unbound DO ACs (AC-33106-1, AC-33108-1, AC-33109-1, AC-33110-1, AC-33111-1) are bound as additional-result anchors on the wrangler-seam, storage-round-trip and concurrent-increment probes where the probe genuinely observes the AC's behaviour; a new probe body is added inside existing capability only if no existing probe carries the observable. A test in the DO anatomy suite asserts each of the thirteen AC ids appears in the union of shipped probe results and each cited result is pass.",
+      "testable": true
+    }
+  ]
+}

package/rcf/user-stories/us-15201.json

@@ -0,0 +1,21 @@
+{
+  "createdAt": "2026-09-08T12:17:34.801Z",
+  "updatedAt": "2026-09-08T12:19:47.822Z",
+  "asA": "rcf-lite maintainer applying messaging-queue-cloudflare v1.0.0",
+  "iWant": "real-account-concurrency-smoke to publish 500 messages through the producer facade wired to a live Queues binding on a deployed Worker and assert concurrent processing up to the documented push-invocation cap when CI_HAS_CLOUDFLARE_ACCOUNT is set (or record accountBoundSkipped when it is not)",
+  "soThat": "the real-account run proves the queue actually processes messages concurrently on Cloudflare (not just that credentials are present) and the accountBoundSkipped pass-stub can never again be reached from account-flag presence alone",
+  "description": "Part of H-2. Cloudflare Queues does not support wrangler dev --remote, so the real-account driver rides a deployed Worker that binds the queue (queue name and binding parameterised via env; HQ supplies values at gate time, canonical queue rcf-lite-ci-queue-smoke per HQ runbook). The account-set branch publishes 500 messages, waits for delivery under a bounded timeout, and asserts concurrent processing per the documented push-invocation cap. Local proof against miniflare or wrangler dev (local queue simulation). The env-absent branch keeps pass-with-skip. The documented Cloudflare Queues limits URL (https://developers.cloudflare.com/queues/platform/limits/) is re-verified 200 at merge time and logged in the PR provenance transcript.",
+  "usId": "US-15201",
+  "prdId": "PRD-001",
+  "reqId": "REQ-152",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "H-2 queue real concurrency driver: real-account-concurrency-smoke publishes 500 messages through the producer facade against a live Queues binding on a deployed Worker and asserts concurrent processing up to the documented push-invocation cap",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-15201-1",
+      "description": "When CI_HAS_CLOUDFLARE_ACCOUNT is set with the deployed-Worker binding env vars, real-account-concurrency-smoke publishes 500 messages through the producer facade wired to a live Queues binding on the deployed Worker (queue name and binding parameterised via env, canonical queue rcf-lite-ci-queue-smoke), waits under a bounded timeout for all 500 to be observed on the consumer side, and asserts concurrent processing occurred (observed max-in-flight consumers greater than one, up to and not exceeding the documented push-invocation cap read from Cloudflare Queues limits). accountBoundSkipped is never set on the account-set branch; a pass is unreachable from account-flag presence alone. Local proof: the same driver path against miniflare or wrangler dev with local queue simulation. Env-absent branch keeps section 3.5 pass-with-skip. The documented limits URL https://developers.cloudflare.com/queues/platform/limits/ is fetched once at merge time, must answer 200 and is logged in the PR provenance transcript.",
+      "testable": true
+    }
+  ]
+}