rcf-lite 0.25.0 → 0.27.0

package/blueprints/edge-cloudflare-tunnel/guide/edge-cloudflare-tunnel.md

@@ -7,15 +7,13 @@ what the connector looks like, what the manifest looks like, how the
 Access-gated shape composes on top of the public-hostname shape, and
 how the credentials-file discipline stays honest on every reapply.
 
-Ratifying spec: `projects/blueprint-library/specs/hetzner-round-7-spec-2026-09-07.md` section 5.3.
-
 ## When to reach for this blueprint
 
 Reach when the applying project needs to expose a service on the public
 internet without opening origin ports on the host and without standing
 up a bespoke reverse proxy in front of the CDN. The tunnel connector
 dials out to the Cloudflare edge and terminates ingress there; the host
-firewall (T-1 deploy-hetzner-server) can stay closed on 80/443 unless a
+firewall (from deploy-hetzner-server) can stay closed on 80/443 unless a
 reverse proxy is also applied.
 
 Do not reach for this blueprint when the applying project runs on
@@ -34,10 +32,10 @@ Reach for **compose-service** (the shipped default when `containerHost`
 is applied) when the applying project already runs docker compose on
 the host. The connector ships as another service in the same stack,
 sharing the compose network, the log driver and the restart discipline.
-The T-2 platform-docker-compose-host contract makes this the natural
-home; the connector composes on `containerHost` from T-2.
+The platform-docker-compose-host contract makes this the natural
+home; the connector composes on `containerHost` from platform-docker-compose-host.
 
-Reach for **systemd-unit** when the host runs bare (only T-1 applied)
+Reach for **systemd-unit** when the host runs bare (only deploy-hetzner-server applied)
 and there is no compose stack to add a service to. The connector runs
 as a systemd unit per the vendor cloudflared as-a-service documented
 systemd unit; the unit file lives at `/etc/systemd/system/cloudflared.service`
@@ -71,9 +69,15 @@ authorisation lives at the origin). The tunnel still terminates
 ingress at the CF edge; no origin port is opened; the difference is
 that cloudflared does not check for a JWT before forwarding.
 
-Graceful degrade: when Access is not applied, the blueprint still ships
-in public-hostname mode. The `aud-presence-check` probe runs on both
-fixture variants and asserts the shape flips correctly.
+Mode selection is a pure function of the applied capability set. When
+`zeroTrustGate` is present on the applied capabilities, the elicited
+`access-aud` value is **mandatory**: apply refuses with code
+`apply.tunnel-aud-missing` if the value is blank, and every ingress
+rule attaches an `originRequest.access` block. There is no silent
+degrade to public-hostname mode under an applied gate. When
+`zeroTrustGate` is absent, the tunnel serves in the deliberate
+public-hostname mode per ADR-4003; the `aud-presence-check` probe
+runs on both fixture variants and asserts the shape flips correctly.
 
 ## Tunnel manifest walkthrough
 
@@ -83,7 +87,7 @@ The applying project ships one tunnel manifest per named tunnel at
 ```yaml
 tunnel: 12345678-90ab-4cde-8f12-3456789abcde
 credentialsFile:
-  secretRef: hq-estate/CLOUDFLARE_TUNNEL_CREDENTIALS_MY_PROJECT
+  secretRef: vault/CLOUDFLARE_TUNNEL_CREDENTIALS_MY_PROJECT
 ingress:
   - hostname: my-app.example.com
     service: http://web:8080
@@ -96,7 +100,7 @@ non-catch-all rule:
 ```yaml
 tunnel: 12345678-90ab-4cde-8f12-3456789abcde
 credentialsFile:
-  secretRef: hq-estate/CLOUDFLARE_TUNNEL_CREDENTIALS_MY_PROJECT
+  secretRef: vault/CLOUDFLARE_TUNNEL_CREDENTIALS_MY_PROJECT
 ingress:
   - hostname: my-app.example.com
     service: http://web:8080
@@ -117,6 +121,49 @@ Every ingress service URL must bind to an internal address (a compose
 service name or a loopback interface); binding to `0.0.0.0` or a
 non-loopback numeric IP refuses at apply time.
 
+## Zone resolution
+
+The applying project stores the target Cloudflare zone id as a secret
+reference rather than as a plaintext value in the tracked tree. TAC-4004
+owns the zone-resolution seam: at apply the resolver reads the elicited
+`cloudflare-zone-secret` through the `security-secrets-management`
+companion, and the resulting applied sidecar records only the
+`secretRef`. A grep across the applying tree for the resolved zone id
+must find zero matches on the tracked file set. Failure paths, per
+REQ-006:
+
+- If the elicited `cloudflare-zone-secret` does not resolve via the
+  vault seam (the reference is missing, or the seam returns an error),
+  apply refuses with `apply.zone-unresolved` naming the elicit id and
+  writes no sidecar (US-39109 AC-tunnel-zoneUnresolved).
+- If the Cloudflare API returns 401 or 403 on the tunnel-route call for
+  the resolved zone id, apply refuses with `apply.zone-unauthorised`
+  naming the resolved zone id metadata (never the token) and writes no
+  sidecar (US-39109 AC-tunnel-zoneUnauthorised).
+
+## Public-hostname template expansion
+
+TAC-4004 owns the public-hostname template. The default template is
+`<service>.<zone>` and each ingress rule's public hostname is rendered
+by substituting the `service` placeholder with the ingress rule's
+service name and the `zone` placeholder with the resolved zone. Every
+rendered hostname must match the DNS-label regex
+`^[a-z0-9-]+(\.[a-z0-9-]+)+$`. Failure paths, per REQ-007:
+
+- If the template names an undefined placeholder (for example
+  `<unknown>`), carries an unclosed brace (for example
+  `<service.<zone>`), or renders a value that violates DNS-label rules
+  (labels longer than 63 characters, or characters outside `[a-z0-9-]`),
+  apply refuses with `apply.hostname-template-malformed` naming the
+  offending template and writes no sidecar (US-39110
+  AC-tunnel-hostnameTemplateMalformed).
+- If two distinct service names expand under the elicited template to
+  the same concrete hostname (for example a template with the
+  `<service>` placeholder omitted or replaced by a constant), apply
+  refuses with `apply.hostname-template-duplicate` naming the collided
+  hostname and both offending rule indices; no sidecar is written
+  (US-39110 AC-tunnel-hostnameTemplateDuplicate).
+
 ## Credentials rotation pattern
 
 The tunnel credentials JSON file lands on the host at mode 0o400 (owner
@@ -150,7 +197,7 @@ Provides: `tunnelBridge` capability; new global topic
 The `deliver-ci-workflows` shelf blueprint invokes the two account-bound
 probes on a scratch subdomain when the account tokens are present;
 without them the probes record `accountBoundSkipped: true` and the
-aggregate flips to pass per hetzner-round-7-spec section 3.5.
+aggregate flips to pass when both env vars are absent.
 
 ## Running the probes
 
@@ -180,7 +227,7 @@ Mutations (fixture-side, one per switch; the probe modules never read
 
 Real-account probes need `CI_HAS_CLOUDFLARE_ACCOUNT=true` and
 `CI_HAS_HETZNER_ACCOUNT=true` (plus `CI_HAS_CLOUDFLARE_ACCESS=true` for
-the gated sub-case per the round-7 Q4 ratification):
+the gated sub-case):
 
 ```
 CI_HAS_CLOUDFLARE_ACCOUNT=true CI_HAS_HETZNER_ACCOUNT=true \

package/blueprints/edge-cloudflare-turnstile/CHANGELOG.md

@@ -1,6 +1,38 @@
 # Changelog
 
+## 1.1.3 - 2026-09-10
+
+Positive-evidence rule alignment on the probe pack skip path (authoring standard section 7d).
+
+- Fixture: added a "Declared env vars" section to the fixture README (`packages/rcf-lite/test/fixtures/probe-pack-edge-cloudflare-turnstile/README.md`) declaring every env var the fixture and its probes read, per authoring standard section 7d. Probe pack itself unchanged (no account-bound branch).
+
+
+## 1.1.2 - 2026-09-10
+
+Capability token named in the requirements layer; single-mechanism story legality notes; magic-link guard probe extended with a mint-count delta assertion.
+
+- Extended REQ-001 description to name the declared `humanCheck` capability token verbatim with a one-line runtime clause tying the token to the client widget mount that delivers it.
+- Added AC-35101-3 on US-35101 as a fixed AC that binds the manifest-declared `humanCheck` token to the widget-render mechanism the fixture surfaces.
+- Appended the section 7a legality note to AC-35106-1, AC-35107-1 and AC-35108-1 recording that each single-AC story's mechanism has no additional documented failure path in the guide or the anchored TAC.
+- Extended the magic-link-guard probe check (`AC-turnstile-magicLinkGuard` in `probe-packs/edge-cloudflare-turnstile.pack.mjs`) to read a pre-mint and post-mint mint-outcome count from the fixture's `/api/events` sink and return `pass` only when both refusals are observed AND the mint-outcome delta is exactly zero; the observed delta is included in the positive-evidence detail.
+
+## 1.1.1 (register-sweep patch, 2026-09-10)
+
+- Register: neutral wording in shipped prose (no capability change).
+
+## 1.1.0 - 2026-09-09
+
+hardening pass edge (criterion a REQ-layer backing; criterion b AC-set sufficiency; criterion c chain consistency lint-zero on pass 1 and pass 2).
+
+- Normalised the `cf-turnstile-response` token casing across the shipped guide, README, REQs, TACs and user stories to the lowercase form-field literal Cloudflare's client-side rendering and server-side validation docs specify verbatim (closes specimen F-1 in the vendor-fact direction under 7b; earlier interim pass mistakenly took the pre-existing TAC-3601 title-case as canonical). TAC-3601 owns the literal with a `vendorCitation` and US-35101 AC-35101-1 is re-marked `fixed` with the same citation. The consistency-lint AC-3 spec test continues to assert the specimen is closed on the shipped blueprint.
+- Added failure-path ACs to US-35102 (AC-35102-2..4 close F-3: missing sitekey, missing secret, only-one-of-pair boot refusal) and US-35103 (AC-35103-2..6 close F-2: siteverify timeout, network failure, non-2xx upstream, invalid JSON, missing success-field fail-closed).
+- Every REQ now carries `deliveredBy`; every AC carries `disposition` (`AC-35102-1` and `AC-35103-1` marked `fixed` with vendor citations to the Cloudflare Turnstile testing docs); ACs referencing owner-owned literals carry `ownerRef`.
+- Chain-consistency lint reports 0 findings on both passes.
+
+
 All notable changes to `edge-cloudflare-turnstile` are recorded here. The shape follows Keep a Changelog and Semantic Versioning per the blueprint authoring standard.
+- Review fix pass (2026-09-09): flipped `cf-turnstile-response` to the lowercase vendor literal per Cloudflare's client-side rendering and server-side validation docs across guide, README, CHANGELOG, REQ-001, REQ-003, TAC-3601, TAC-3602, US-35101, US-35104 and US-35105 (closes F-1 blocker in the vendor-fact direction); TAC-3601 responsibility 3 owns the literal and US-35101 AC-35101-1 re-marked `fixed` with `vendorCitation` at the client-side-rendering page. Added `AC-35101-2` for the always-fail test-sitekey mount branch (`fixed`, `vendorCitation` at the Cloudflare testing docs). Split US-35104 into canonical-shape (guard-shape-scan) and missing-token-runtime (400 turnstile.token-missing) ACs each with a concrete oracle and an `ownerRef` into TAC-3602. Vendor citations added on US-35101 AC-35101-1/2, US-35102 AC-35102-1, US-35103 AC-35103-1, US-35104 AC-35104-2, US-35105 AC-35105-2 and US-35106 AC-35106-1. Every AC in this blueprint is `fixed` (refusal codes, event-secrecy record shapes, probe verdicts and vendor test-key observables are all mechanism-invariant). Genuinely single-mechanism stories (US-35106, US-35107, US-35108) carry the section-7a note inside the story `description` field, not in a schema-illegal new field.
+
 
 ## 1.0.0 (2026-09-07)
 
@@ -13,7 +45,7 @@ All notable changes to `edge-cloudflare-turnstile` are recorded here. The shape
 - 4 elicited parameters on `blueprint.json`: `turnstile-sitekey`, `turnstile-secret` (routed through `security-secrets-management` when applied), `turnstile-widget-mode` (enum default `managed`), `turnstile-guarded-surfaces`.
 - `suggestedCompanions`: `logging` (for the metadata-only event sink retention), `errorHandling` (for the verifier failure boundary), `secretsManagement` (for the paired sitekey and secret).
 - Ships the dedicated pack fixture at `packages/rcf-lite/test/fixtures/probe-pack-edge-cloudflare-turnstile/` per spec section 3.3. The fixture pins the Cloudflare public test keys documented at `https://developers.cloudflare.com/turnstile/troubleshooting/testing/` as environment defaults so the pack runs without real Turnstile credentials.
-- Anatomy test at `packages/rcf-lite/test/blueprint/edge-cloudflare-turnstile-anatomy.test.js` covers TS-120..127 on the T-5 repo-chain slice.
+- Anatomy test at `packages/rcf-lite/test/blueprint/edge-cloudflare-turnstile-anatomy.test.js` covers TS-120..127 on the repo-chain slice.
 
 ### Known limitations
 

package/blueprints/edge-cloudflare-turnstile/README.md

@@ -20,9 +20,9 @@ Cloudflare Turnstile as a CAPTCHA-alternative on public-facing forms. Ships the
 
 ## Contract at a glance
 
-- **Client widget mount** (TAC-3601) injects Cloudflare Turnstile JS from `https://challenges.cloudflare.com` and no other origin; renders the widget for the elicited sitekey; populates the hidden `Cf-Turnstile-Response` token field on submit.
+- **Client widget mount** (TAC-3601) injects Cloudflare Turnstile JS from `https://challenges.cloudflare.com` and no other origin; renders the widget for the elicited sitekey; populates the hidden `cf-turnstile-response` token field on submit.
 - **Server-side siteverify verifier** (TAC-3602) POSTs `{secret, response}` to `https://challenges.cloudflare.com/turnstile/v0/siteverify`. On `success:true` the handler proceeds. On `success:false` the handler rejects with 400 and the refusal body carries the documented `error-codes` value; the sitekey is never in the refusal body.
-- **Refuse-if-token-missing guard** (TAC-3602) is the sole reader of the `Cf-Turnstile-Response` payload field; a submit without a token rejects with `400 {"errorCode":"turnstile.token-missing"}` before any downstream handler runs.
+- **Refuse-if-token-missing guard** (TAC-3602) is the sole reader of the `cf-turnstile-response` payload field; a submit without a token rejects with `400 {"errorCode":"turnstile.token-missing"}` before any downstream handler runs.
 - **Composition with security-auth-magic-link** (TAC-3603) registers the magic-link mint route under the Turnstile guard so a mint submit reads through the same token check.
 - **Widget mode** (ADR-3602) is an elicited enum: `managed`, `non-interactive`, `invisible`. Default: `managed`.
 

package/blueprints/edge-cloudflare-turnstile/blueprint.json

@@ -1,6 +1,6 @@
 {
   "slug": "edge-cloudflare-turnstile",
-  "version": "1.0.0",
+  "version": "1.1.3",
   "category": "edge",
   "capabilities": [
     "humanCheck"

package/blueprints/edge-cloudflare-turnstile/contributions/requirements/edge-cloudflare-turnstile-req-001.json

@@ -2,7 +2,7 @@
   "reqId": "edge-cloudflare-turnstile-REQ-001",
   "prdId": "PRD-001",
   "title": "Client widget mount: an elicited sitekey renders the Turnstile widget and the mount injects no third-party script beyond Cloudflare Turnstile JS host",
-  "description": "The applying project reaches Cloudflare Turnstile through a client widget mount that renders on elicited surfaces using the elicited TURNSTILE_SITEKEY. The mount injects only Cloudflare Turnstile JS from the Cloudflare Turnstile host (https://challenges.cloudflare.com/turnstile/v0/api.js per https://developers.cloudflare.com/turnstile/) and no other third-party script. On submit the widget populates a hidden Cf-Turnstile-Response token field the form payload carries.",
+  "description": "The applying project reaches Cloudflare Turnstile through a client widget mount that renders on elicited surfaces using the elicited TURNSTILE_SITEKEY. The mount injects only Cloudflare Turnstile JS from the Cloudflare Turnstile host (https://challenges.cloudflare.com/turnstile/v0/api.js per https://developers.cloudflare.com/turnstile/) and no other third-party script. On submit the widget populates a hidden cf-turnstile-response token field the form payload carries. Delivers the declared `humanCheck` capability token: the client widget mount is the runtime surface the token names, so once the applying project renders the widget on an elicited surface the `humanCheck` promise binds every submit the surface accepts.",
   "category": "functional",
   "domain": "edge",
   "priority": "must",
@@ -13,5 +13,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-07T20:00:00.000Z",
-  "updatedAt": "2026-09-07T20:00:00.000Z"
+  "updatedAt": "2026-09-10T00:00:00.000Z",
+  "deliveredBy": {
+    "tacId": "TAC-3601-edge-cloudflare-turnstile-widget-mount",
+    "field": "interfaces.mountTurnstile"
+  }
 }

package/blueprints/edge-cloudflare-turnstile/contributions/requirements/edge-cloudflare-turnstile-req-002.json

@@ -13,5 +13,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-07T20:00:00.000Z",
-  "updatedAt": "2026-09-07T20:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00.000Z",
+  "deliveredBy": {
+    "tacId": "TAC-3602-edge-cloudflare-turnstile-server-verifier",
+    "field": "interfaces.createTurnstileVerifier"
+  }
 }

package/blueprints/edge-cloudflare-turnstile/contributions/requirements/edge-cloudflare-turnstile-req-003.json

@@ -2,7 +2,7 @@
   "reqId": "edge-cloudflare-turnstile-REQ-003",
   "prdId": "PRD-001",
   "title": "Refuse-if-token-missing guard on elicited surfaces: a submit without a token is rejected with 400 before any downstream logic",
-  "description": "The applying project registers a token-required guard at every elicited surface. A submit whose payload lacks the Cf-Turnstile-Response field is rejected with 400 before any downstream handler runs. The refusal body carries a stable error-code (turnstile.token-missing), not the sitekey.",
+  "description": "The applying project registers a token-required guard at every elicited surface. A submit whose payload lacks the cf-turnstile-response field is rejected with 400 before any downstream handler runs. The refusal body carries a stable error-code (turnstile.token-missing), not the sitekey.",
   "category": "functional",
   "domain": "edge",
   "priority": "must",
@@ -13,5 +13,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-07T20:00:00.000Z",
-  "updatedAt": "2026-09-07T20:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00.000Z",
+  "deliveredBy": {
+    "tacId": "TAC-3602-edge-cloudflare-turnstile-server-verifier",
+    "field": "interfaces.verifier.guard"
+  }
 }

package/blueprints/edge-cloudflare-turnstile/contributions/requirements/edge-cloudflare-turnstile-req-004.json

@@ -13,5 +13,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-07T20:00:00.000Z",
-  "updatedAt": "2026-09-07T20:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00.000Z",
+  "deliveredBy": {
+    "tacId": "TAC-3603-edge-cloudflare-turnstile-magic-link-hook",
+    "field": "responsibilities.guardMint"
+  }
 }

package/blueprints/edge-cloudflare-turnstile/contributions/requirements/edge-cloudflare-turnstile-req-005.json

@@ -13,5 +13,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-07T20:00:00.000Z",
-  "updatedAt": "2026-09-07T20:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00.000Z",
+  "deliveredBy": {
+    "adrId": "ADR-3602-edge-cloudflare-turnstile-widget-mode",
+    "field": "decision.widgetModeEnum"
+  }
 }

package/blueprints/edge-cloudflare-turnstile/contributions/tacs/tac-3601-edge-cloudflare-turnstile-widget-mount.json

@@ -5,11 +5,11 @@
   "version": "1.0.0",
   "status": "approved",
   "name": "Turnstile client widget mount with elicited sitekey and third-party script pin",
-  "purpose": "The client-side widget mount module for Cloudflare Turnstile. Mounts the Turnstile widget on elicited surfaces with the elicited TURNSTILE_SITEKEY. Injects only Cloudflare Turnstile JS from the Cloudflare Turnstile host (https://challenges.cloudflare.com/turnstile/v0/api.js per https://developers.cloudflare.com/turnstile/) and no other third-party script. Populates the hidden Cf-Turnstile-Response token field on submit. Widget mode is per ADR-3602 (managed, non-interactive, invisible).",
+  "purpose": "The client-side widget mount module for Cloudflare Turnstile. Mounts the Turnstile widget on elicited surfaces with the elicited TURNSTILE_SITEKEY. Injects only Cloudflare Turnstile JS from the Cloudflare Turnstile host (https://challenges.cloudflare.com/turnstile/v0/api.js per https://developers.cloudflare.com/turnstile/) and no other third-party script. Populates the hidden cf-turnstile-response token field on submit. Widget mode is per ADR-3602 (managed, non-interactive, invisible).",
   "responsibilities": [
     "Render the Turnstile widget on every elicited surface with the elicited TURNSTILE_SITEKEY (AC-35101-1).",
     "Inject only Cloudflare Turnstile JS from the Cloudflare Turnstile host; refuse any other third-party script.",
-    "Populate the hidden Cf-Turnstile-Response token field on the form payload before submit fires.",
+    "Populate the hidden cf-turnstile-response token field on the form payload before submit fires.",
     "Honour the elicited widget mode enum: managed, non-interactive, invisible (AC-35106-1)."
   ],
   "internalStructure": "One client module realising the Turnstile mount. In the pack fixture the mount is inline in the served HTML for auditability; in an applied Workers project the mount ships as a small module the operator drops into the elicited surface.",

package/blueprints/edge-cloudflare-turnstile/contributions/tacs/tac-3602-edge-cloudflare-turnstile-server-verifier.json

@@ -5,7 +5,7 @@
   "version": "1.0.0",
   "status": "approved",
   "name": "Turnstile server-side siteverify verifier and refuse-if-token-missing guard",
-  "purpose": "The server-side verifier module. POSTs {secret, response} to https://challenges.cloudflare.com/turnstile/v0/siteverify per Cloudflare Turnstile documented endpoint. On success:true proceeds; on success:false rejects 400 with error-codes body per ADR-3603. The refuse-if-token-missing guard is the sole reader of the Cf-Turnstile-Response payload field and rejects missing-token submits with 400 before any downstream handler runs.",
+  "purpose": "The server-side verifier module. POSTs {secret, response} to https://challenges.cloudflare.com/turnstile/v0/siteverify per Cloudflare Turnstile documented endpoint. On success:true proceeds; on success:false rejects 400 with error-codes body per ADR-3603. The refuse-if-token-missing guard is the sole reader of the cf-turnstile-response payload field and rejects missing-token submits with 400 before any downstream handler runs.",
   "responsibilities": [
     "Own the ONLY reference to https://challenges.cloudflare.com/turnstile/v0/siteverify in the applied source tree (AC-35102-1, AC-35103-1).",
     "Read TURNSTILE_SECRET only via env-shaped facade; refuse any inline literal (AC-35107-1).",
@@ -27,7 +27,7 @@
     {
       "name": "verifier.guard",
       "kind": "method",
-      "summary": "Middleware that reads Cf-Turnstile-Response and rejects missing-token submits with 400."
+      "summary": "Middleware that reads cf-turnstile-response and rejects missing-token submits with 400."
     }
   ],
   "dependencies": [],

package/blueprints/edge-cloudflare-turnstile/contributions/user-stories/edge-cloudflare-turnstile-us-35101.json

@@ -6,22 +6,63 @@
   "status": "approved",
   "title": "Turnstile client widget mounts with the elicited sitekey and injects no third-party script beyond the Cloudflare Turnstile host",
   "asA": "shelf consumer applying the edge-cloudflare-turnstile v1.0.0 blueprint on a Workers project using the probe-pack-edge-cloudflare-turnstile fixture",
-  "iWant": "the Turnstile widget to mount on my public form with the elicited TURNSTILE_SITEKEY, to inject only Cloudflare Turnstile JS and no other third-party script, and to populate the hidden Cf-Turnstile-Response token field on submit",
+  "iWant": "the Turnstile widget to mount on my public form with the elicited TURNSTILE_SITEKEY, to inject only Cloudflare Turnstile JS and no other third-party script, and to populate the hidden cf-turnstile-response token field on submit",
   "soThat": "every submit that reaches my server carries a Turnstile response my server-side verifier can check and the browser has loaded no scripts I did not authorise",
   "acceptanceCriteria": [
     {
       "id": "AC-35101-1",
-      "description": "When the fixture page loads with the pinned always-pass test sitekey (1x00000000000000000000AA per https://developers.cloudflare.com/turnstile/troubleshooting/testing/), the Turnstile widget mounts and an iframe whose src origin is https://challenges.cloudflare.com is present; the page loads no third-party script from any other origin; the form payload on submit carries a non-empty Cf-Turnstile-Response value.",
+      "description": "When the fixture page loads with the pinned always-pass test sitekey (1x00000000000000000000AA per https://developers.cloudflare.com/turnstile/troubleshooting/testing/), the Turnstile widget mounts and an iframe whose src origin is https://challenges.cloudflare.com is present; the page loads no third-party script from any other origin; the form payload on submit carries a non-empty cf-turnstile-response value.",
       "given": "the pack fixture form loaded with default sitekey=pass and the pinned always-pass test sitekey applied",
       "when": "the widget renders and the operator submits",
-      "then": "the Turnstile widget is mounted, its iframe origin is Cloudflare Turnstile only, and the submit payload contains the Cf-Turnstile-Response token",
+      "then": "the Turnstile widget is mounted, its iframe origin is Cloudflare Turnstile only, and the submit payload contains the cf-turnstile-response token",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3601-edge-cloudflare-turnstile-widget-mount",
+        "field": "responsibilities.tokenFieldPopulate"
+      },
+      "vendorCitation": {
+        "url": "https://developers.cloudflare.com/turnstile/get-started/client-side-rendering/",
+        "verifiedOn": "2026-09-09"
+      }
+    },
+    {
+      "id": "AC-35101-2",
+      "description": "When the fixture page loads with the pinned always-fail test sitekey (2x00000000000000000000AB per https://developers.cloudflare.com/turnstile/troubleshooting/testing/), the Turnstile widget mounts and an iframe whose src origin is https://challenges.cloudflare.com is present; the widget's always-fail branch is observable client-side and the form payload on submit carries a cf-turnstile-response value the server-side verifier will reject as invalid-input-response.",
+      "given": "the pack fixture form loaded with the pinned always-fail test sitekey (2x00000000000000000000AB)",
+      "when": "the widget renders and the operator submits",
+      "then": "the Turnstile widget is mounted from the Cloudflare Turnstile origin only, no third-party script from any other origin loads, and the submit payload carries a cf-turnstile-response value that the server-side verifier will reject per US-35103 AC-35103-1",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3601-edge-cloudflare-turnstile-widget-mount",
+        "field": "responsibilities.tokenFieldPopulate"
+      },
+      "vendorCitation": {
+        "url": "https://developers.cloudflare.com/turnstile/troubleshooting/testing/",
+        "verifiedOn": "2026-09-09"
+      }
+    },
+    {
+      "id": "AC-35101-3",
+      "description": "The applied blueprint's manifest declares the `humanCheck` capability token and the elicited surface renders the Cloudflare Turnstile widget with the pinned test sitekey per AC-35101-1; therefore the `humanCheck` promise the manifest carries is backed by a live widget the applying project can submit through.",
+      "given": "the applied blueprint manifest at `blueprints/edge-cloudflare-turnstile/blueprint.json` and the pack fixture serving the elicited surface at `packages/rcf-lite/test/fixtures/probe-pack-edge-cloudflare-turnstile/`",
+      "when": "the widget-rendered check reads the blueprint manifest and mounts the fixture surface",
+      "then": "the manifest carries `humanCheck` on its `capabilities[]` list and the fixture surface renders the Turnstile widget from the Cloudflare Turnstile origin only, so `humanCheck` is a live promise the applying project can act on",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3601-edge-cloudflare-turnstile-widget-mount",
+        "field": "interfaces.mountTurnstile"
+      }
     }
   ],
   "tacIds": [
     "TAC-3601-edge-cloudflare-turnstile-widget-mount"
   ],
   "createdAt": "2026-09-07T20:00:00.000Z",
-  "updatedAt": "2026-09-07T20:00:00.000Z"
+  "updatedAt": "2026-09-10T00:00:00.000Z"
 }

package/blueprints/edge-cloudflare-turnstile/contributions/user-stories/edge-cloudflare-turnstile-us-35102.json

@@ -16,12 +16,63 @@
       "when": "a submit hits /api/submit with any response token",
       "then": "the server-side POST to siteverify returns success:true and the handler responds 200",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3602-edge-cloudflare-turnstile-server-verifier",
+        "field": "interfaces.verifier.verify"
+      },
+      "vendorCitation": {
+        "url": "https://developers.cloudflare.com/turnstile/troubleshooting/testing/",
+        "verifiedOn": "2026-09-09"
+      }
+    },
+    {
+      "id": "AC-35102-2",
+      "description": "Given the pack fixture with an empty TURNSTILE_SITEKEY in the environment, when the applying project boots, the widget mount refuses to render with a stable turnstile.sitekey-missing error and no submit surface is reachable until the sitekey is set.",
+      "given": "the pack fixture running with TURNSTILE_SITEKEY unset or empty",
+      "when": "the applying project boots and a client loads a guarded surface",
+      "then": "the widget mount refuses to render, the guarded surface returns 503 with body {\"errorCode\":\"turnstile.sitekey-missing\"} and no downstream handler runs",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3601-edge-cloudflare-turnstile-widget-mount",
+        "field": "interfaces.mountTurnstile"
+      }
+    },
+    {
+      "id": "AC-35102-3",
+      "description": "Given the pack fixture with an empty TURNSTILE_SECRET in the environment, when the verifier is constructed at boot, createTurnstileVerifier refuses with a stable turnstile.secret-missing error before any siteverify traffic can fire.",
+      "given": "the pack fixture running with TURNSTILE_SECRET unset or empty",
+      "when": "the verifier factory runs at boot and no downstream handler is registered",
+      "then": "createTurnstileVerifier throws {code:\"turnstile.secret-missing\"} and no siteverify network call is issued",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3602-edge-cloudflare-turnstile-server-verifier",
+        "field": "interfaces.createTurnstileVerifier"
+      }
+    },
+    {
+      "id": "AC-35102-4",
+      "description": "Given the pack fixture with only one of the pair present (TURNSTILE_SITEKEY set and TURNSTILE_SECRET unset, or vice versa), when boot runs, the config refuses with a stable turnstile.pair-incomplete error naming which half is missing.",
+      "given": "the pack fixture running with exactly one of the sitekey/secret pair set",
+      "when": "boot runs and the elicited pair is inspected",
+      "then": "boot refuses with {code:\"turnstile.pair-incomplete\", missing:\"sitekey\"|\"secret\"} and no verifier or widget mount initialises",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3602-edge-cloudflare-turnstile-server-verifier",
+        "field": "interfaces.createTurnstileVerifier"
+      }
     }
   ],
   "tacIds": [
     "TAC-3602-edge-cloudflare-turnstile-server-verifier"
   ],
   "createdAt": "2026-09-07T20:00:00.000Z",
-  "updatedAt": "2026-09-07T20:00:00.000Z"
+  "updatedAt": "2026-09-09T12:00:00.000Z"
 }

package/blueprints/edge-cloudflare-turnstile/contributions/user-stories/edge-cloudflare-turnstile-us-35103.json

@@ -16,12 +16,91 @@
       "when": "a submit hits /api/submit with any response token and the verifier calls siteverify",
       "then": "siteverify returns success:false and the handler responds 400 with an error-codes body and no sitekey leak",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3602-edge-cloudflare-turnstile-server-verifier",
+        "field": "interfaces.verifier.verify"
+      },
+      "vendorCitation": {
+        "url": "https://developers.cloudflare.com/turnstile/troubleshooting/testing/",
+        "verifiedOn": "2026-09-09"
+      }
+    },
+    {
+      "id": "AC-35103-2",
+      "description": "Given the pack fixture with the injected fetch simulating a siteverify request timeout (fetch rejects with AbortError after the bounded timeout), when a submit hits /api/submit and the verifier calls siteverify, the handler refuses 502 with body {\"errorCode\":\"turnstile.verifier-timeout\"}, no downstream handler runs, and exactly one metadata-only audit event fires carrying no response-token or secret substring.",
+      "given": "the pack fixture running with an injected fetch that rejects with AbortError after the bounded timeout window",
+      "when": "a submit hits /api/submit carrying a response token and the verifier calls siteverify",
+      "then": "the handler responds 502 with {\"errorCode\":\"turnstile.verifier-timeout\"} and one audit event with metadata only",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3602-edge-cloudflare-turnstile-server-verifier",
+        "field": "interfaces.verifier.verify"
+      }
+    },
+    {
+      "id": "AC-35103-3",
+      "description": "Given an injected fetch that rejects with a network error (ECONNRESET or DNS failure), when the verifier calls siteverify, the handler refuses 502 with body {\"errorCode\":\"turnstile.verifier-network\"}, no downstream handler runs, and the audit event carries no response-token or secret substring.",
+      "given": "the pack fixture with an injected fetch that rejects synchronously with a network error",
+      "when": "the verifier calls siteverify",
+      "then": "the handler responds 502 with {\"errorCode\":\"turnstile.verifier-network\"} and one metadata-only audit event",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3602-edge-cloudflare-turnstile-server-verifier",
+        "field": "interfaces.verifier.verify"
+      }
+    },
+    {
+      "id": "AC-35103-4",
+      "description": "Given an injected fetch returning a 500 status body, when the verifier calls siteverify, the handler refuses 502 with body {\"errorCode\":\"turnstile.verifier-upstream\", \"upstreamStatus\":500}, no downstream handler runs.",
+      "given": "the pack fixture with an injected fetch returning status 500 and any body",
+      "when": "the verifier calls siteverify",
+      "then": "the handler responds 502 with {\"errorCode\":\"turnstile.verifier-upstream\",\"upstreamStatus\":500}",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3602-edge-cloudflare-turnstile-server-verifier",
+        "field": "interfaces.verifier.verify"
+      }
+    },
+    {
+      "id": "AC-35103-5",
+      "description": "Given an injected fetch returning status 200 with a body that is not valid JSON, when the verifier parses the response, the handler refuses 502 with body {\"errorCode\":\"turnstile.verifier-malformed\"} and no downstream handler runs.",
+      "given": "the pack fixture with an injected fetch returning a 200 with a non-JSON body",
+      "when": "the verifier parses the response",
+      "then": "the handler responds 502 with {\"errorCode\":\"turnstile.verifier-malformed\"}",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3602-edge-cloudflare-turnstile-server-verifier",
+        "field": "interfaces.verifier.verify"
+      }
+    },
+    {
+      "id": "AC-35103-6",
+      "description": "Given an injected fetch returning valid JSON with no boolean success field (or success set to a non-boolean), when the verifier interprets the response, the handler refuses 502 with body {\"errorCode\":\"turnstile.verifier-malformed\"} (fail-closed) and no downstream handler runs.",
+      "given": "the pack fixture with an injected fetch returning JSON that omits success or supplies a non-boolean value",
+      "when": "the verifier interprets the response",
+      "then": "the handler responds 502 with {\"errorCode\":\"turnstile.verifier-malformed\"} and treats the outcome as failure",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3602-edge-cloudflare-turnstile-server-verifier",
+        "field": "interfaces.verifier.verify"
+      }
     }
   ],
   "tacIds": [
     "TAC-3602-edge-cloudflare-turnstile-server-verifier"
   ],
   "createdAt": "2026-09-07T20:00:00.000Z",
-  "updatedAt": "2026-09-07T20:00:00.000Z"
+  "updatedAt": "2026-09-09T12:00:00.000Z"
 }

package/blueprints/edge-cloudflare-turnstile/contributions/user-stories/edge-cloudflare-turnstile-us-35104.json

@@ -11,17 +11,40 @@
   "acceptanceCriteria": [
     {
       "id": "AC-35104-1",
-      "description": "The Node probe guard-shape-scan enumerates every elicited surface in the pack fixture source and asserts each is registered under the token-required guard. A live POST to /api/submit without a Cf-Turnstile-Response field is rejected with 400 and refusal body carries error-code turnstile.token-missing; no downstream handler side-effect is observable.",
-      "given": "the pack fixture running with every elicited surface registered under the token-required guard",
-      "when": "a submit reaches /api/submit without a Cf-Turnstile-Response value",
-      "then": "the guard rejects with 400 with an error-code body and no downstream handler runs",
+      "description": "The Node probe guard-shape-scan enumerates every elicited surface in the pack fixture source and asserts each is registered under the token-required guard; the probe returns aggregateVerdict:pass when every elicited surface has the guard wired.",
+      "given": "the pack fixture source tree with the elicited surfaces registered",
+      "when": "guard-shape-scan enumerates every elicited surface",
+      "then": "every surface is registered under the token-required guard and the probe returns aggregateVerdict:pass",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3602-edge-cloudflare-turnstile-server-verifier",
+        "field": "interfaces.verifier.guard"
+      }
+    },
+    {
+      "id": "AC-35104-2",
+      "description": "Given the pack fixture running on 127.0.0.1 with a real /api/submit route, when a live POST reaches /api/submit without a cf-turnstile-response field, the Turnstile guard rejects the submit with HTTP 400 whose body carries `{\"errorCode\":\"turnstile.token-missing\"}` and no downstream handler side-effect is observable.",
+      "given": "the pack fixture running with /api/submit registered under the token-required guard",
+      "when": "a live POST reaches /api/submit without a cf-turnstile-response form field",
+      "then": "the guard rejects with HTTP 400 and body {\"errorCode\":\"turnstile.token-missing\"} and no downstream handler side-effect is observable",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3602-edge-cloudflare-turnstile-server-verifier",
+        "field": "interfaces.verifier.guard"
+      },
+      "vendorCitation": {
+        "url": "https://developers.cloudflare.com/turnstile/get-started/client-side-rendering/",
+        "verifiedOn": "2026-09-09"
+      }
     }
   ],
   "tacIds": [
     "TAC-3602-edge-cloudflare-turnstile-server-verifier"
   ],
   "createdAt": "2026-09-07T20:00:00.000Z",
-  "updatedAt": "2026-09-07T20:00:00.000Z"
+  "updatedAt": "2026-09-09T13:00:00.000Z"
 }