rcf-lite 0.25.0 → 0.27.0

package/blueprints/edge-cloudflare-tunnel/contributions/probes/manifest-schema-validate.mjs

@@ -82,7 +82,7 @@ function validateAgainstSchema(doc, schema) {
 
 function refuseOriginPortRules(doc) {
   // A service URL that binds to a host public interface is a policy
-  // violation for a T-3 apply (no reverse proxy). The catch-all
+  // violation for a tunnel-only apply (no reverse proxy). The catch-all
   // http_status:N is exempt.
   const violations = [];
   const rules = Array.isArray(doc.ingress) ? doc.ingress : [];
@@ -97,11 +97,11 @@ function refuseOriginPortRules(doc) {
     }
     const host = m[1];
     if (host === '0.0.0.0' || host === '') {
-      violations.push(`ingress[${i}] service '${svc}' binds to a host public interface (${host || 'empty'}); T-3 requires internal addresses only`);
+      violations.push(`ingress[${i}] service '${svc}' binds to a host public interface (${host || 'empty'}); tunnel-only apply requires internal addresses only`);
       continue;
     }
     if (/^\d+\.\d+\.\d+\.\d+$/.test(host) && host !== '127.0.0.1') {
-      violations.push(`ingress[${i}] service '${svc}' binds to a numeric IP that is not loopback; T-3 requires internal names or loopback`);
+      violations.push(`ingress[${i}] service '${svc}' binds to a numeric IP that is not loopback; tunnel-only apply requires internal names or loopback`);
     }
   }
   return violations;
@@ -112,7 +112,10 @@ async function eventSecrecyScan(credentialsPath) {
   try {
     creds = JSON.parse(await readFile(credentialsPath, 'utf8'));
   } catch (err) {
-    return { verdict: 'warn', detail: `credentials placeholder read failed: ${err.message}` };
+    return {
+      verdict: 'fail',
+      detail: `credentials placeholder read failed at ${credentialsPath}: ${err.message}. Fix the fixture setup step (packages/rcf-lite/test/fixtures/hetzner-throwaway-server/cloudflared/*/credentials/probe.json.example must exist and parse as JSON) before re-running the probe. A missing placeholder is a fixture-setup defect, not an event-secrecy warning.`,
+    };
   }
   const eventBody = {
     kind: 'cloudflaredReady',

package/blueprints/edge-cloudflare-tunnel/contributions/probes/probe-utils.mjs

@@ -1,4 +1,4 @@
-// Shared helpers for edge-cloudflare-tunnel probes (round-7 T-3).
+// Shared helpers for edge-cloudflare-tunnel probes (round-7 edge).
 //
 // Runtime-dependency posture:
 // - manifest-schema-validate is dependency-free: it reads yaml text and
@@ -122,11 +122,22 @@ export async function runShim(probeName, engine, mainFn) {
 }
 
 export function accountBoundSkippedResult(anchorAcId, envList, note) {
+  // Positive-evidence rule (authoring standard section 7d): a probe that
+  // records `accountBoundSkipped: true` carries a `reason` field naming
+  // the exact env var(s) that were unset. Compute from process.env so
+  // the reason is a fact of the run, not a hand-copied string.
+  const unset = envList.filter((name) => process.env[name] !== 'true');
+  const reason = unset.length > 0 ? unset.join(', ') : envList.join(', ');
+  // Detail names only the variables actually missing, so a partial-skip
+  // (one first-tier gate set, the other unset) reads honestly instead of
+  // claiming the whole input list is unset.
+  const detailUnset = unset.length > 0 ? unset : envList;
   return {
     anchorAcId,
     verdict: 'skipped',
     accountBoundSkipped: true,
-    detail: `accountBound: ${envList.join(' or ')} unset; ${note}`,
+    reason,
+    detail: `accountBound: ${detailUnset.join(' or ')} unset; ${note}`,
   };
 }
 

package/blueprints/edge-cloudflare-tunnel/contributions/probes/real-account-connector-healthy.mjs

@@ -1,27 +1,43 @@
 // Probe: real-account-connector-healthy.
 //
-// anchorAcId: AC-tunnel-connectorHealthy.
-// accountBound: true (gates on CI_HAS_CLOUDFLARE_ACCOUNT AND CI_HAS_HETZNER_ACCOUNT).
+// anchorAcId: AC-tunnel-connectorHealthy (US-39102 contribution;
+// real-account-connector-healthy declared with tunnelConnectorUp).
+// The AC-tunnel-* symbolic anchors on this blueprint ARE the AC ids
+// in the shipped US-39101..US-39108 contribution band (see
+// blueprints/edge-cloudflare-tunnel/contributions/user-stories/
+// edge-cloudflare-tunnel-us-3910N.json); the anchors already resolve
+// to the shipped band, so no re-anchor is needed. The kv treatment
+// differed because those probes anchored AC-5xxx ids that existed
+// nowhere on the shelf; here the ids exist and match by design.
 //
-// Without both env vars the probe records accountBoundSkipped: true and
-// the aggregate flips to pass per hetzner-round-7-spec section 3.5.
+// accountBound: true (gates on CI_HAS_CLOUDFLARE_ACCOUNT AND
+// CI_HAS_HETZNER_ACCOUNT; the connector runs on a throwaway Hetzner
+// server).
 //
-// With both env vars the probe (not exercised in this dispatch; the
-// blueprint author has no account tokens per the dispatch envelope):
-// - Provisions a throwaway Hetzner server via the shared fixture
-//   provision.mjs (T-1 verb).
-// - Stands up cloudflared against a scratch Cloudflare subdomain and asks
-//   the api for `cloudflared tunnel info <name>`; asserts at least one
-//   healthy connector.
-// - Captures a tunnelConnectorUp event with connector id, region and
-//   version metadata (metadata only).
-// - Tears down via destroy.mjs in an always() block.
+// Env-absent branch: pass-with-skip (spec section 3.5).
+// Env-present branch: provisions a throwaway Hetzner server through
+// the shared throwaway-server fixture provisionThrowawayServer, drives the
+// cloudflared control surface through the cf-edge shim's
+// cloudflaredTunnelInfo({ tunnelName }) call, asserts at least one
+// HEALTHY connector, and captures a tunnelConnectorUp event
+// (metadata-only: connector id, region, version). If the fixture
+// provisioning throws (missing HCLOUD_TOKEN, quota, etc.), the
+// probe FAILS with a pointer naming the fixture step: the tunnel
+// connector cannot report healthy on a server that never provisioned.
+//
+// The shim seams (cloudflaredTunnelInfo, event capture) allow the
+// driver path and mutation switches to be exercised locally without
+// a real Cloudflare account; the real-account run happens in the operator account
+// gate time.
 
 import { runShim, accountBoundSkippedResult } from './probe-utils.mjs';
 
 export const anchorAcIds = ['AC-tunnel-connectorHealthy'];
 export const accountBound = true;
 
+const TUNNEL_NAME_ENV = 'CF_TUNNEL_NAME';
+const DEFAULT_TUNNEL_NAME = 'h2-cf-probe-integrity-scratch';
+
 export default async function runProbe() {
   const results = [];
   const extra = {
@@ -30,6 +46,7 @@ export default async function runProbe() {
       CI_HAS_CLOUDFLARE_ACCOUNT: process.env.CI_HAS_CLOUDFLARE_ACCOUNT === 'true',
       CI_HAS_HETZNER_ACCOUNT: process.env.CI_HAS_HETZNER_ACCOUNT === 'true',
     },
+    events: [],
   };
   const hasAll = extra.envPresent.CI_HAS_CLOUDFLARE_ACCOUNT && extra.envPresent.CI_HAS_HETZNER_ACCOUNT;
   if (!hasAll) {
@@ -40,15 +57,86 @@ export default async function runProbe() {
     ));
     return { results, extra };
   }
-  results.push({
-    anchorAcId: 'AC-tunnel-connectorHealthy',
-    verdict: 'warn',
-    detail: 'account-bound path present in this dispatch environment but not exercised by the blueprint-author role; run under the delivery-ci-workflows lane with the account tokens loaded.',
-  });
-  return { results, extra };
+
+  // Env-present path: real driver. All account-bound work runs through
+  // the cf-edge shim, which itself delegates to the hetzner fixture in
+  // production and returns synthetic responses under the fixture-side
+  // H2_CF_TUNNEL_SHIM_MODE token. Probe body reads no mutation-switch
+  // env var and imports no fixture module directly.
+  const {
+    provisionScratchServer, destroyScratchServer, cloudflaredTunnelInfo,
+  } = await import(
+    '../../../../packages/rcf-lite/test/fixtures/cf-edge/h2-cf-tunnel-shim.mjs'
+  );
+
+  const runId = process.env.GITHUB_RUN_ID || `local-${Date.now()}`;
+  let provisioned = null;
+  try {
+    provisioned = await provisionScratchServer({ runId });
+    extra.provisioned = {
+      id: provisioned.id, name: provisioned.name, location: provisioned.location, shimMode: provisioned.shimMode,
+    };
+  } catch (err) {
+    results.push({
+      anchorAcId: 'AC-tunnel-connectorHealthy',
+      verdict: 'fail',
+      detail: `fixture provisionScratchServer failed: ${err.message}. The tunnel connector cannot report healthy on a server that never provisioned. Fix the fixture step (packages/rcf-lite/test/fixtures/hetzner-throwaway-server/provision.mjs) or the account tokens (HCLOUD_TOKEN) before re-running.`,
+    });
+    return { results, extra };
+  }
+
+  try {
+    const tunnelName = process.env[TUNNEL_NAME_ENV] || DEFAULT_TUNNEL_NAME;
+    extra.tunnelName = tunnelName;
+    let info;
+    try {
+      info = await cloudflaredTunnelInfo({ tunnelName });
+    } catch (err) {
+      results.push({
+        anchorAcId: 'AC-tunnel-connectorHealthy',
+        verdict: 'fail',
+        detail: `cloudflared tunnel info shim call failed: ${err.message}. Fix the cf-edge shim (packages/rcf-lite/test/fixtures/cf-edge/h2-cf-tunnel-shim.mjs) or the cloudflared control surface before re-running.`,
+      });
+      return { results, extra };
+    }
+    extra.shimMode = info.shimMode;
+    extra.connectorCount = info.connectors.length;
+    const healthy = info.connectors.filter((c) => String(c.status || '').toUpperCase() === 'HEALTHY');
+    if (healthy.length === 0) {
+      results.push({
+        anchorAcId: 'AC-tunnel-connectorHealthy',
+        verdict: 'fail',
+        detail: `cloudflared tunnel info returned ${info.connectors.length} connector(s), none HEALTHY. Statuses observed: ${info.connectors.map((c) => String(c.status || 'MISSING')).join(', ') || '(no connectors)'}.`,
+      });
+      return { results, extra };
+    }
+    // Capture tunnelConnectorUp event, metadata only (id, region, version).
+    for (const c of healthy) {
+      extra.events.push({
+        kind: 'tunnelConnectorUp',
+        connectorId: String(c.id ?? ''),
+        region: String(c.region ?? ''),
+        version: String(c.version ?? ''),
+      });
+    }
+    results.push({
+      anchorAcId: 'AC-tunnel-connectorHealthy',
+      verdict: 'pass',
+      detail: `cloudflared tunnel info returned ${info.connectors.length} connector(s), ${healthy.length} HEALTHY (shim mode ${info.shimMode}); tunnelConnectorUp event captured for each healthy connector with metadata-only payload (connectorId, region, version).`,
+    });
+    return { results, extra };
+  } finally {
+    // Always attempt teardown; a failed teardown is a fixture concern
+    // and rides sweep-orphans, not this probe.
+    try {
+      await destroyScratchServer(provisioned);
+    } catch (_err) {
+      // Best-effort; the nightly sweep-orphans job collects any leak.
+    }
+  }
 }
 
-const engine = { kind: 'real-account-cloudflared-info', image: 'cloudflared + hcloud (throwaway server)', healthy: true };
+const engine = { kind: 'real-account-cloudflared-info', image: 'cloudflared + hcloud (throwaway server) via cf-edge shim', healthy: true };
 if (import.meta.url === `file://${process.argv[1]}`) {
   await runShim('real-account-connector-healthy', engine, runProbe);
 }

package/blueprints/edge-cloudflare-tunnel/contributions/probes/real-account-tunnel-hostname-routes.mjs

@@ -1,28 +1,45 @@
 // Probe: real-account-tunnel-hostname-routes.
 //
-// anchorAcId list:
-// - AC-tunnel-hostnameRoutes (public-hostname sub-case)
-// - AC-tunnel-accessGated (access-gated sub-case, gated on CI_HAS_CLOUDFLARE_ACCESS)
-// accountBound: true (CI_HAS_CLOUDFLARE_ACCOUNT AND CI_HAS_HETZNER_ACCOUNT for
-// the public-hostname sub-case; add CI_HAS_CLOUDFLARE_ACCESS for the
-// access-gated sub-case per Q4 ratification).
+// anchorAcId list (the AC-tunnel-* ids
+// ARE the shipped AC ids in the US-39104 / US-39106 contribution
+// bodies):
+// - AC-tunnel-hostnameRoutes (public-hostname sub-case: ingress rule
+//   routes public hostname to internal service URL and returns 200).
+// - AC-tunnel-accessGated (access-gated sub-case: Access-gated
+//   composition; unauthenticated request refused, JWT-carrying
+//   request accepted; per US-39106).
 //
-// Without the env vars the sub-cases skip independently and each records
-// accountBoundSkipped: true. The aggregate flips to pass per hetzner-
-// round-7-spec section 3.5.
+// accountBound: true.
+// Gating (amendment 4 verbatim):
+// - Public-hostname sub-case activated on CI_HAS_CLOUDFLARE_ACCOUNT
+//   AND CI_HAS_HETZNER_ACCOUNT.
+// - Access-gated sub-case activated only when CI_HAS_CLOUDFLARE_ACCESS
+//   is ALSO set. Env-absent branch keeps pass-with-skip; a pass must
+//   never be reachable from CI_HAS_CLOUDFLARE_ACCOUNT presence alone.
+// - Deployment note: Cloudflare Access is not enabled on the operator account, so
+//   at gate time the AUD sub-case stays pass-with-skip; expected,
+//   not a driver defect.
 //
-// With the env vars (not exercised in this dispatch; the blueprint
-// author has no account tokens per the dispatch envelope):
-// - Public-hostname sub-case: undici curl against the scratch subdomain,
-//   asserts 200 and the internal service payload.
-// - Access-gated sub-case: two fixture identities; the JWT-less request
-//   is refused at the edge; the JWT-carrying request proceeds.
+// Env-present, sub-case active: undici-based fetch driver against the
+// scratch subdomain via the cf-edge shim (production path uses Node's
+// built-in fetch; shim-synthetic path lets local runs exercise the
+// driver body without account access). For the access-gated
+// sub-case: send an unauthenticated request (must be refused with
+// 4xx) AND a JWT-carrying request (must be accepted with 2xx). A
+// pass requires BOTH results.
 
 import { runShim, accountBoundSkippedResult } from './probe-utils.mjs';
 
 export const anchorAcIds = ['AC-tunnel-hostnameRoutes', 'AC-tunnel-accessGated'];
 export const accountBound = true;
 
+const PUBLIC_URL_ENV = 'CF_TUNNEL_PUBLIC_URL';
+const ACCESS_URL_ENV = 'CF_TUNNEL_ACCESS_URL';
+const ACCESS_AUDIENCE_ENV = 'CF_ACCESS_AUDIENCE';
+const ACCESS_TEAM_SECRET_ENV = 'CF_ACCESS_TEAM_SECRET';
+const DEFAULT_PUBLIC_URL = 'https://h2-cf-public.scratch.example.invalid/health';
+const DEFAULT_ACCESS_URL = 'https://h2-cf-gated.scratch.example.invalid/protected';
+
 export default async function runProbe() {
   const results = [];
   const extra = {
@@ -38,36 +55,112 @@ export default async function runProbe() {
   };
   const hasPublic = extra.envPresent.CI_HAS_CLOUDFLARE_ACCOUNT && extra.envPresent.CI_HAS_HETZNER_ACCOUNT;
   const hasGated = hasPublic && extra.envPresent.CI_HAS_CLOUDFLARE_ACCESS;
+
   if (!hasPublic) {
     results.push(accountBoundSkippedResult(
       'AC-tunnel-hostnameRoutes',
       ['CI_HAS_CLOUDFLARE_ACCOUNT', 'CI_HAS_HETZNER_ACCOUNT'],
-      'public-hostname sub-case: undici curl against the scratch subdomain not exercised. Set CI_HAS_CLOUDFLARE_ACCOUNT=true AND CI_HAS_HETZNER_ACCOUNT=true to run this path.',
+      'public-hostname sub-case: undici fetch against the scratch subdomain not exercised. Set CI_HAS_CLOUDFLARE_ACCOUNT=true AND CI_HAS_HETZNER_ACCOUNT=true to run this path.',
     ));
-  } else {
-    results.push({
-      anchorAcId: 'AC-tunnel-hostnameRoutes',
-      verdict: 'warn',
-      detail: 'public-hostname sub-case: account-bound path present but not exercised by the blueprint-author role; run under the delivery-ci-workflows lane.',
-    });
   }
   if (!hasGated) {
     results.push(accountBoundSkippedResult(
       'AC-tunnel-accessGated',
       ['CI_HAS_CLOUDFLARE_ACCOUNT', 'CI_HAS_HETZNER_ACCOUNT', 'CI_HAS_CLOUDFLARE_ACCESS'],
-      'access-gated sub-case: two-identity JWT check against the scratch subdomain not exercised. Requires all three env vars (CI_HAS_CLOUDFLARE_ACCESS added per Q4 ratification).',
+      'access-gated sub-case: two-identity JWT check against the scratch subdomain not exercised. Requires all three env vars; a pass here is unreachable from CI_HAS_CLOUDFLARE_ACCOUNT presence alone (amendment 4 verbatim).',
     ));
-  } else {
-    results.push({
-      anchorAcId: 'AC-tunnel-accessGated',
-      verdict: 'warn',
-      detail: 'access-gated sub-case: account-bound path present but not exercised by the blueprint-author role; run under the delivery-ci-workflows lane.',
-    });
   }
+  if (!hasPublic && !hasGated) {
+    return { results, extra };
+  }
+
+  // Sub-case active: load the shim seams.
+  const { fetchTunnelHostname, mintScratchIdentity } = await import(
+    '../../../../packages/rcf-lite/test/fixtures/cf-edge/h2-cf-tunnel-shim.mjs'
+  );
+
+  if (hasPublic) {
+    const url = process.env[PUBLIC_URL_ENV] || DEFAULT_PUBLIC_URL;
+    extra.publicHostnameUrl = url;
+    try {
+      const resp = await fetchTunnelHostname(url, { method: 'GET' });
+      extra.publicHostnameResponse = { status: resp.status, shimMode: resp.shimMode, bodyLength: resp.textBody.length };
+      if (resp.status >= 200 && resp.status < 300) {
+        results.push({
+          anchorAcId: 'AC-tunnel-hostnameRoutes',
+          verdict: 'pass',
+          detail: `public-hostname sub-case: fetch(${url}) returned ${resp.status} (shim mode ${resp.shimMode}), body length ${resp.textBody.length}. Ingress rule routes the public hostname to the internal service URL.`,
+        });
+      } else {
+        results.push({
+          anchorAcId: 'AC-tunnel-hostnameRoutes',
+          verdict: 'fail',
+          detail: `public-hostname sub-case: fetch(${url}) returned ${resp.status} (shim mode ${resp.shimMode}). Expected 2xx; the ingress rule did not route the public hostname to a healthy internal service.`,
+        });
+      }
+    } catch (err) {
+      results.push({
+        anchorAcId: 'AC-tunnel-hostnameRoutes',
+        verdict: 'fail',
+        detail: `public-hostname sub-case: fetch(${url}) threw: ${err.message}. Check the scratch subdomain, the tunnel manifest ingress rules, or the cf-edge shim.`,
+      });
+    }
+  }
+
+  if (hasGated) {
+    const url = process.env[ACCESS_URL_ENV] || DEFAULT_ACCESS_URL;
+    const audience = process.env[ACCESS_AUDIENCE_ENV] || 'h2-cf-scratch-audience';
+    const secret = process.env[ACCESS_TEAM_SECRET_ENV] || 'h2-cf-scratch-team-secret';
+    extra.accessGatedUrl = url;
+    let refusalResp;
+    let acceptResp;
+    try {
+      refusalResp = await fetchTunnelHostname(url, { method: 'GET' });
+    } catch (err) {
+      results.push({
+        anchorAcId: 'AC-tunnel-accessGated',
+        verdict: 'fail',
+        detail: `access-gated sub-case: unauthenticated fetch(${url}) threw: ${err.message}.`,
+      });
+      return { results, extra };
+    }
+    try {
+      const jwt = mintScratchIdentity({ audience, subject: 'h2-cf-scratch-identity', secret });
+      acceptResp = await fetchTunnelHostname(url, {
+        method: 'GET',
+        headers: { authorization: `Bearer ${jwt}` },
+      });
+    } catch (err) {
+      results.push({
+        anchorAcId: 'AC-tunnel-accessGated',
+        verdict: 'fail',
+        detail: `access-gated sub-case: JWT-carrying fetch(${url}) threw: ${err.message}.`,
+      });
+      return { results, extra };
+    }
+    extra.accessGatedRefusal = { status: refusalResp.status, shimMode: refusalResp.shimMode };
+    extra.accessGatedAccept = { status: acceptResp.status, shimMode: acceptResp.shimMode };
+    const refused = refusalResp.status >= 400 && refusalResp.status < 500;
+    const accepted = acceptResp.status >= 200 && acceptResp.status < 300;
+    if (refused && accepted) {
+      results.push({
+        anchorAcId: 'AC-tunnel-accessGated',
+        verdict: 'pass',
+        detail: `access-gated sub-case: unauthenticated request refused with ${refusalResp.status} and JWT-carrying request accepted with ${acceptResp.status} (shim mode ${refusalResp.shimMode}). Access gate composed correctly.`,
+      });
+    } else {
+      results.push({
+        anchorAcId: 'AC-tunnel-accessGated',
+        verdict: 'fail',
+        detail: `access-gated sub-case: expected 4xx-then-2xx; observed refusal status ${refusalResp.status} and JWT-accept status ${acceptResp.status} (shim mode ${refusalResp.shimMode}). Gate is drifted: unauthenticated request should be refused and JWT request accepted.`,
+      });
+    }
+  }
+
   return { results, extra };
 }
 
-const engine = { kind: 'real-account-tunnel-curl', image: 'undici + cloudflared (scratch subdomain)', healthy: true };
+const engine = { kind: 'real-account-tunnel-fetch', image: 'undici fetch + cf-edge shim (scratch subdomain)', healthy: true };
 if (import.meta.url === `file://${process.argv[1]}`) {
   await runShim('real-account-tunnel-hostname-routes', engine, runProbe);
 }

package/blueprints/edge-cloudflare-tunnel/contributions/requirements/edge-cloudflare-tunnel-req-001.json

@@ -2,7 +2,7 @@
   "reqId": "edge-cloudflare-tunnel-REQ-001",
   "prdId": "PRD-001",
   "title": "Connector install shape switches on applied containerHost (compose-service default; systemd-unit for bare cloudHost); cloudflaredReady fires on boot",
-  "description": "The blueprint contributes a cloudflared connector whose runtime shape is elicited via ADR-4002 with enum {compose-service, systemd-unit} and recommendedDefault compose-service. When containerHost is applied (T-2 platform-docker-compose-host on top of T-1 deploy-hetzner-server) the connector ships as a compose service alongside the applying project services on the same web-net network. When the host runs bare (only T-1 applied) the connector ships as a systemd unit per the vendor local-configuration-file docs. Either shape emits cloudflaredReady on boot with connector id, region and version metadata (metadata only; no token or credentials in the payload).",
+  "description": "The blueprint contributes a cloudflared connector whose runtime shape is elicited via ADR-4002 with enum {compose-service, systemd-unit} and recommendedDefault compose-service. When containerHost is applied (via platform-docker-compose-host on top of deploy-hetzner-server) the connector ships as a compose service alongside the applying project services on the same web-net network. When the host runs bare (only deploy-hetzner-server applied) the connector ships as a systemd unit per the vendor local-configuration-file docs. Either shape emits cloudflaredReady on boot with connector id, region and version metadata (metadata only; no token or credentials in the payload). Names the declared `tunnelBridge` capability token: the connector shape is the runtime that supplies the token, so once the applying project boots either variant the `tunnelBridge` promise is live.",
   "category": "functional",
   "domain": "edge",
   "priority": "must",
@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-08T00:00:00.000Z",
-  "updatedAt": "2026-09-08T00:00:00.000Z"
+  "updatedAt": "2026-09-10T00:00:00.000Z",
+  "deliveredBy": {
+    "tacId": "TAC-4001-edge-cloudflare-tunnel-connector-shape",
+    "field": "responsibilities.cloudflaredReady"
+  }
 }

package/blueprints/edge-cloudflare-tunnel/contributions/requirements/edge-cloudflare-tunnel-req-002.json

@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-08T00:00:00.000Z",
-  "updatedAt": "2026-09-08T00:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00.000Z",
+  "deliveredBy": {
+    "tacId": "TAC-4002-edge-cloudflare-tunnel-manifest-schema",
+    "field": "responsibilities.manifestSchema"
+  }
 }

package/blueprints/edge-cloudflare-tunnel/contributions/requirements/edge-cloudflare-tunnel-req-003.json

@@ -1,8 +1,8 @@
 {
   "reqId": "edge-cloudflare-tunnel-REQ-003",
   "prdId": "PRD-001",
-  "title": "No public origin ports on the host (T-1 firewall stays 22 open plus 80/443 only when a reverse proxy is applied; manifest refuses an origin-port request)",
-  "description": "The applying project MUST NOT open a public port on the host firewall for the origin path when only edge-cloudflare-tunnel provides ingress. T-1 deploy-hetzner-server firewall allows 22 unconditionally and 80/443 only when a reverse proxy is applied. A project applying only T-1 plus T-3 (no reverse proxy) declares zero 80/443 rules; the tunnel manifest schema refuses ingress rules whose service URL binds to a host public interface.",
+  "title": "No public origin ports on the host (the deploy-hetzner-server firewall stays 22 open plus 80/443 only when a reverse proxy is applied; manifest refuses an origin-port request)",
+  "description": "The applying project MUST NOT open a public port on the host firewall for the origin path when only edge-cloudflare-tunnel provides ingress. The deploy-hetzner-server firewall allows 22 unconditionally and 80/443 only when a reverse proxy is applied. A project applying only deploy-hetzner-server and edge-cloudflare-tunnel (no reverse proxy) declares zero 80/443 rules; the tunnel manifest schema refuses ingress rules whose service URL binds to a host public interface.",
   "category": "functional",
   "domain": "edge",
   "priority": "must",
@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-08T00:00:00.000Z",
-  "updatedAt": "2026-09-08T00:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00.000Z",
+  "deliveredBy": {
+    "tacId": "TAC-4002-edge-cloudflare-tunnel-manifest-schema",
+    "field": "responsibilities.noPublicOrigin"
+  }
 }

package/blueprints/edge-cloudflare-tunnel/contributions/requirements/edge-cloudflare-tunnel-req-004.json

@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-08T00:00:00.000Z",
-  "updatedAt": "2026-09-08T00:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00.000Z",
+  "deliveredBy": {
+    "tacId": "TAC-4003-edge-cloudflare-tunnel-access-binding",
+    "field": "responsibilities.accessGated"
+  }
 }

package/blueprints/edge-cloudflare-tunnel/contributions/requirements/edge-cloudflare-tunnel-req-005.json

@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-08T00:00:00.000Z",
-  "updatedAt": "2026-09-08T00:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00.000Z",
+  "deliveredBy": {
+    "tacId": "TAC-4002-edge-cloudflare-tunnel-manifest-schema",
+    "field": "responsibilities.credentialsDiscipline"
+  }
 }

package/blueprints/edge-cloudflare-tunnel/contributions/requirements/edge-cloudflare-tunnel-req-006.json

@@ -0,0 +1,22 @@
+{
+  "reqId": "edge-cloudflare-tunnel-REQ-006",
+  "prdId": "PRD-001",
+  "title": "Zone resolution and AUD-mandatory-when-gated: elicited cloudflare-zone-secret resolves via the vault seam; access-aud is mandatory whenever zeroTrustGate is applied",
+  "description": "At apply time the elicited cloudflare-zone-secret (a security-secrets-management reference) is resolved via the applied vault seam. The plaintext zone id never lands on disk in the applying tree; only a secretRef reaches the manifest and the applied sidecar. An unresolved reference refuses apply with code apply.zone-unresolved. A Cloudflare API 4xx on the tunnel-route call for the resolved zone refuses apply with code apply.zone-unauthorised. Additionally, when zeroTrustGate is present on appliedCapabilities, the elicited access-aud MUST be non-blank; apply refuses with code apply.tunnel-aud-missing otherwise (never a silent public-hostname fallback under an applied gate).",
+  "category": "security",
+  "domain": "edge",
+  "priority": "must",
+  "rationale": "Closes the review P0 F-1 (elicit collected and ignored) and specimen F-3 (access-aud silent-degrade precedence). Aligns the zone-secret elicit with security-secrets-management discipline; ties the AUD-mandatory reading of REQ-004 to a machine-observable apply refusal.",
+  "tags": [
+    "blueprint:edge-cloudflare-tunnel",
+    "capability:tunnelBridge"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-09T00:00:00.000Z",
+  "updatedAt": "2026-09-09T00:00:00.000Z",
+  "deliveredBy": {
+    "tacId": "TAC-4004-edge-cloudflare-tunnel-zone-and-hostname-apply",
+    "field": "responsibilities.zoneResolve"
+  }
+}

package/blueprints/edge-cloudflare-tunnel/contributions/requirements/edge-cloudflare-tunnel-req-007.json

@@ -0,0 +1,22 @@
+{
+  "reqId": "edge-cloudflare-tunnel-REQ-007",
+  "prdId": "PRD-001",
+  "title": "Public-hostname template expansion at apply: inputs, output, malformed refusal and duplicate refusal",
+  "description": "The elicited public-hostname-template (default <service>.<zone>) is expanded per ingress rule at apply time. Substitution inputs are exactly two placeholders: <service> (the ingress rule service name) and <zone> (the resolved zone domain). The output is a fully-qualified DNS name committed to the ingress rule and to the applied sidecar. A template with an undefined placeholder, an unclosed brace, or a rendered value that violates DNS label rules (labels longer than 63 chars, empty labels, characters outside [a-z0-9-]) refuses apply with code apply.hostname-template-malformed. Two ingress rules expanding to the same concrete hostname refuses apply with code apply.hostname-template-duplicate.",
+  "category": "functional",
+  "domain": "edge",
+  "priority": "must",
+  "rationale": "Closes review P0 F-2 (hostname-template elicit collected and ignored). Names the substitution inputs, the output, the malformed refusal and the duplicate refusal so apply can bind each failure mode to an AC.",
+  "tags": [
+    "blueprint:edge-cloudflare-tunnel",
+    "capability:tunnelBridge"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-09T00:00:00.000Z",
+  "updatedAt": "2026-09-09T00:00:00.000Z",
+  "deliveredBy": {
+    "tacId": "TAC-4004-edge-cloudflare-tunnel-zone-and-hostname-apply",
+    "field": "responsibilities.hostnameTemplateExpand"
+  }
+}

package/blueprints/edge-cloudflare-tunnel/contributions/tacs/tac-4001-edge-cloudflare-tunnel-connector-shape.json

@@ -5,7 +5,7 @@
   "version": "1.0.0",
   "status": "approved",
   "name": "Edge-cloudflare-tunnel connector install shape",
-  "purpose": "The cloudflared connector installs in one of two runtime shapes as selected by ADR-4002 from the applied capability set. When containerHost is applied (T-2 platform-docker-compose-host on top of T-1 deploy-hetzner-server) the connector ships as a compose service alongside the applying project services on the same web-net network with no host ports and a healthcheck. When the host runs bare (only T-1 applied) the connector ships as a systemd unit per the vendor local-configuration-file docs. Either shape emits cloudflaredReady on boot with connector id, region and version metadata (metadata only).",
+  "purpose": "The cloudflared connector installs in one of two runtime shapes as selected by ADR-4002 from the applied capability set. When containerHost is applied (via platform-docker-compose-host on top of deploy-hetzner-server) the connector ships as a compose service alongside the applying project services on the same web-net network with no host ports and a healthcheck. When the host runs bare (only deploy-hetzner-server applied) the connector ships as a systemd unit per the vendor local-configuration-file docs. Either shape emits cloudflaredReady on boot with connector id, region and version metadata (metadata only).",
   "responsibilities": [
     "Ship the compose-service variant under packages/rcf-lite/test/fixtures/hetzner-throwaway-server/cloudflared/compose-service/ (AC-tunnel-connectorShape).",
     "Ship the systemd-unit variant under packages/rcf-lite/test/fixtures/hetzner-throwaway-server/cloudflared/systemd-unit/ (AC-tunnel-connectorShape).",

package/blueprints/edge-cloudflare-tunnel/contributions/tacs/tac-4004-edge-cloudflare-tunnel-zone-and-hostname-apply.json

@@ -0,0 +1,29 @@
+{
+  "tacId": "TAC-4004-edge-cloudflare-tunnel-zone-and-hostname-apply",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "name": "Zone resolution and public-hostname template expansion at apply",
+  "purpose": "The apply-verb path in the blueprint reads the elicited cloudflare-zone-secret (a security-secrets-management reference resolved at apply time), fetches the zone id via the vault seam, and never inlines the identifier into a manifest. The same apply pass expands the elicited public-hostname-template (default <service>.<zone>) per ingress rule to produce concrete hostnames. Apply refuses on: unresolved zone reference, unauthorised zone (Cloudflare API returns 4xx on the tunnel-route call), malformed hostname template, duplicate expanded hostnames across ingress rules. The DNS route for each expanded hostname is created via the Cloudflare API tunnels-routes endpoint or validated to already exist; a failed route creation refuses apply. This TAC anchors AC-tunnel-zoneResolve, AC-tunnel-zoneUnauthorised, AC-tunnel-hostnameTemplateExpand, AC-tunnel-hostnameTemplateMalformed, AC-tunnel-hostnameTemplateDuplicate and AC-tunnel-audMandatoryWhenGated.",
+  "responsibilities": [
+    "Resolve the elicited cloudflare-zone-secret via the security-secrets-management vault seam at apply; refuse apply.zone-unresolved when the reference does not resolve (AC-tunnel-zoneResolve).",
+    "Never inline the resolved zone id into the tunnel manifest or the applied sidecar in plaintext; only a secretRef reaches disk (AC-tunnel-zoneResolve).",
+    "Refuse apply.zone-unauthorised when the Cloudflare API returns 4xx on the tunnel-route call for the resolved zone (AC-tunnel-zoneUnauthorised).",
+    "Expand the elicited public-hostname-template per ingress rule to produce concrete hostnames; template inputs are {service, zone} and the output is the fully-qualified hostname the ingress rule commits to (AC-tunnel-hostnameTemplateExpand).",
+    "Refuse apply.hostname-template-malformed when the template contains an undefined placeholder, an unclosed brace, or expands to an invalid DNS label (AC-tunnel-hostnameTemplateMalformed).",
+    "Refuse apply.hostname-template-duplicate when two or more ingress rules expand to the same concrete hostname (AC-tunnel-hostnameTemplateDuplicate).",
+    "Refuse apply.tunnel-aud-missing when zeroTrustGate is applied and the elicited access-aud is blank (AC-tunnel-audMandatoryWhenGated)."
+  ],
+  "internalStructure": "One apply-time module that reads the elicited zone and hostname template, resolves the zone via security-secrets-management, calls the Cloudflare API tunnel-route endpoint per expanded hostname, and writes the applied sidecar with the concrete hostnames plus a secretRef for the zone (never the plaintext zone id).",
+  "interfaces": [
+    {
+      "name": "resolveZoneAndExpandHostnames",
+      "kind": "facade",
+      "summary": "Apply-time facade returning the resolved zone secretRef and the array of concrete hostname expansions per ingress rule."
+    }
+  ],
+  "dependencies": [],
+  "createdAt": "2026-09-09T00:00:00.000Z",
+  "updatedAt": "2026-09-09T00:00:00.000Z"
+}