rcf-lite 0.25.0 → 0.27.0

package/rcf/code-nodes/cn-500.json

@@ -0,0 +1,12 @@
+{
+  "cnId": "CN-500",
+  "path": "../../blueprints/object-storage-s3/blueprint.json",
+  "implementsAcIds": [
+    "AC-14001-1"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-08T09:04:04.994Z",
+  "updatedAt": "2026-09-08T09:04:04.994Z"
+}

package/rcf/code-nodes/cn-510.json

@@ -0,0 +1,12 @@
+{
+  "cnId": "CN-510",
+  "path": "../../blueprints/deploy-hetzner-server/blueprint.json",
+  "implementsAcIds": [
+    "AC-14501-1"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-08T10:52:56.753Z",
+  "updatedAt": "2026-09-08T10:52:56.753Z"
+}

package/rcf/code-nodes/cn-520.json

@@ -0,0 +1,14 @@
+{
+  "cnId": "CN-520",
+  "path": "../../blueprints/platform-cloudflare-kv/blueprint.json",
+  "implementsAcIds": [
+    "AC-15001-1",
+    "AC-15001-2",
+    "AC-15401-2"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-08T12:22:33.507Z",
+  "updatedAt": "2026-09-08T12:23:01.646Z"
+}

package/rcf/code-nodes/cn-521.json

@@ -0,0 +1,12 @@
+{
+  "cnId": "CN-521",
+  "path": "../../packages/rcf-lite/test/fixtures/cf-platform/h2-cf-kv-cache-aside-shim.mjs",
+  "implementsAcIds": [
+    "AC-15401-1"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-08T12:22:47.292Z",
+  "updatedAt": "2026-09-08T12:23:44.676Z"
+}

package/rcf/code-nodes/cn-522.json

@@ -0,0 +1,13 @@
+{
+  "cnId": "CN-522",
+  "path": "../../packages/rcf-lite/test/blueprint/platform-cloudflare-kv-anatomy.test.js",
+  "implementsAcIds": [
+    "AC-15001-1",
+    "AC-15001-2"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-08T12:22:47.694Z",
+  "updatedAt": "2026-09-08T12:22:47.694Z"
+}

package/rcf/code-nodes/cn-523.json

@@ -0,0 +1,12 @@
+{
+  "cnId": "CN-523",
+  "path": "../../packages/rcf-lite/test/fixtures/cf-platform/h2-cf-kv-event-secrecy-shim.mjs",
+  "implementsAcIds": [
+    "AC-15401-1"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-08T12:23:45.054Z",
+  "updatedAt": "2026-09-08T12:23:45.054Z"
+}

package/rcf/code-nodes/cn-524.json

@@ -0,0 +1,14 @@
+{
+  "cnId": "CN-524",
+  "path": "../../blueprints/platform-cloudflare-durable-objects/blueprint.json",
+  "implementsAcIds": [
+    "AC-15101-1",
+    "AC-15101-2",
+    "AC-15401-3"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-08T13:01:58.227Z",
+  "updatedAt": "2026-09-08T13:01:58.227Z"
+}

package/rcf/code-nodes/cn-525.json

@@ -0,0 +1,12 @@
+{
+  "cnId": "CN-525",
+  "path": "../../blueprints/messaging-queue-cloudflare/blueprint.json",
+  "implementsAcIds": [
+    "AC-15201-1"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-08T13:01:58.602Z",
+  "updatedAt": "2026-09-08T13:01:58.602Z"
+}

package/rcf/code-nodes/cn-526.json

@@ -0,0 +1,14 @@
+{
+  "cnId": "CN-526",
+  "path": "../../blueprints/edge-cloudflare-tunnel/blueprint.json",
+  "implementsAcIds": [
+    "AC-15301-1",
+    "AC-15301-2",
+    "AC-15301-3"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-08T13:01:58.994Z",
+  "updatedAt": "2026-09-08T13:01:58.994Z"
+}

package/rcf/fbs/fbs-160.json

@@ -0,0 +1,15 @@
+{
+  "createdAt": "2026-09-08T09:03:37.649Z",
+  "updatedAt": "2026-09-08T09:03:57.443Z",
+  "acIds": [
+    "AC-14001-1"
+  ],
+  "fbsId": "FBS-160",
+  "prdId": "PRD-001",
+  "bsId": "BS-001",
+  "buildOrder": 63,
+  "executionStatus": "notStarted",
+  "title": "Adapter object-storage-s3 v1.1.0 Hetzner Object Storage: minor bump adds hetznerObjectStorage provider; new hetzner-endpoint helper on the fixture side; new hetzner-object-storage-round-trip probe (accountBound gated on CI_HAS_HETZNER_OBJECT_STORAGE); MinIO round-5 T-2 probes and R2 smoke unchanged",
+  "summary": "HQ round-7 follow-up: object-storage-s3 v1.1.0 minor bump adding the Hetzner Object Storage provider value under the shipped S3-API facade contract (blueprints/object-storage-s3/, was 1.0.0). Delta contributions on the blueprint side (target 4): one blueprint REQ object-storage-s3-REQ-101 (Hetzner endpoint-shape contract), one blueprint US object-storage-s3-US-28110 with AC-28110-1 (labelled AC-hetznerObjectStorage-endpointRoundTrip), one blueprint TAC TAC-2904-object-storage-s3-hetzner-endpoint-helper, one blueprint ADR ADR-2905-object-storage-s3-hetzner-object-storage-provider with standardsTraceClause 'Hetzner Object Storage S3 compatibility documented endpoint shape'. Every existing v1.0.0 contribution id byte-identical (no renumber, no reshape). Extends the shared fixture packages/rcf-lite/test/fixtures/infra-s3-and-queue/ (no second fixture directory) with src/hetzner-endpoint.mjs (composes <bucket>.<location>.your-objectstorage.com from an elicited bucket and location per Hetzner storage overview fsn1/hel1/nbg1 codes) plus a fixture-side shim run-hetzner-object-storage-round-trip.mjs. New Node-only probe blueprints/object-storage-s3/contributions/probes/hetzner-object-storage-round-trip.mjs (accountBound true, gated on CI_HAS_HETZNER_OBJECT_STORAGE, records accountBoundSkipped when unset per spec section 3.5); mutation SIMULATE_HETZNER_ENDPOINT_MISSHAPEN true (fixture-side INPUT-side mutation) composes an invalid endpoint via the fixture shim and the probe FAILS naming the missing subdomain. The round-5 T-2 shipped probes (facade-round-trip, put-get-round-trip, presigned-url, multipart-upload, event-secrecy) and the R2 real-account smoke stay unchanged and continue to pass byte-identical on the extended fixture. Blueprint README extended with a Hetzner Object Storage sub-section under the provider-choice section; guide extended with a Hetzner sub-section; blueprint CHANGELOG gains a 1.1.0 entry; shelf-wide topics.md sweep updates the object-storage-s3 row from shipped v1.0.0 to shipped v1.1.0 across every blueprint's docs/topics.md per the round-6 admin-console 1.1.0 precedent (PR #169). rcf-lite package version does NOT bump for this follow-up (spec section 8). Repo chain: REQ-140, US-14001 with AC-14001-1, TS-170 with TC-170-hetzner-endpoint-round-trip-and-skipped-shape, FBS-160 (buildOrder 63), CN-500, plus blueprint REQ-101 and blueprint US-28110 as blueprint-owned deltas, minted via rcf define create --id per HQ round-7 follow-up reserved-block ruling 2026-09-08 (adapter block REQ-140..144 / TS-170..174 / FBS-160..164 / CN-500..509). Base commit origin/main 25ccece.",
+  "dependsOnFbsIds": []
+}

package/rcf/fbs/fbs-165.json

@@ -0,0 +1,15 @@
+{
+  "createdAt": "2026-09-08T10:52:49.604Z",
+  "updatedAt": "2026-09-08T10:52:49.604Z",
+  "summary": "H-1 patch train against deploy-hetzner-server (blueprint bump 1.0.0 to 1.0.1; every existing contribution id byte-identical) and the shared throwaway-Hetzner-server fixture at packages/rcf-lite/test/fixtures/hetzner-throwaway-server/. Defect list from projects/blueprint-library/reports/real-account-r7-2026-09-08/README.md CONCERNS: (1) provision.mjs reads camelCase off the hcloud JSON (publicNet.ipv4.ip, datacenter.location.name, serverType.name) but hcloud emits snake_case (public_net, server_type, datacenter.location.name); fix reads s.public_net.ipv4.ip, s.datacenter.location.name, s.server_type.name; (2) provision.mjs expects hetzner/servers/rendered/ci-throwaway.cloud-init.yaml that nothing writes; fix renders inline via src/cloud-init-renderer.mjs before hcloud server create fires; (3) renderer substitutes ssh key NAMES into ssh_authorized_keys; fix resolves each name to its public-key material via hcloud ssh-key describe <name> --output json and inlines the .publicKey text; (4) destroy.mjs and sweep-orphans.mjs pass --output json to delete verbs that reject the flag; fix drops it and the tolerant JSON parser accepts arrays; (5) src/snapshot-verb.mjs calls a non-existent hcloud image create-image; fix shells hcloud server create-image --type snapshot --description <label> <id> and recovers the created snapshot id via hcloud image list --type=snapshot --output json by matching the serverName label; (6) src/ssh-baseline-check.mjs runs ssh immediately after provisionThrowawayServer; fix polls port 22 open plus a trivial ssh true exec, bounded up to 6 minutes, before firing the six baseline checks; (7) the deploy user has no NOPASSWD sudo in the rendered user-data; fix adds a write_files sudoers.d fragment granting NOPASSWD to that user with mode 0440; (9) hetzner/servers/ci-throwaway.json hard-codes sshKeyIds ['rcf-lite-ci']; fix adds an env override RCF_LITE_CI_SSH_KEY_NAME resolved at provision time with the manifest value as default, documented in the fixture README. Defect (8) T-2 and T-3 stub drivers are OUT of scope (H-2 owns them). Also: hcloud-dry-run-mock and the two other T-1 mocked probes gain fixture-side SIMULATE_ switches that alter INPUT only, satisfying the mutation-purity gate row; the mock reads the same rendered cloud-init the real path consumes and asserts an ssh public-key line and a NOPASSWD directive for the deploy user. Report envelopes under .rcf/reports/blueprints/deploy-hetzner-server/ regenerated from the REAL run under Baz one-off approval 2026-09-08 (repo-relative paths only, no secrets). CHANGELOG 1.0.1 entry lists the fixes by defect number. Chain: HQ hardening block H-1 REQ-145..149 / TS-175..179 / FBS-165..169 / CN-510..519 per HQ chain-block ruling 2026-09-08. Base commit origin/main 231bc74.",
+  "acIds": [
+    "AC-14501-1"
+  ],
+  "fbsId": "FBS-165",
+  "prdId": "PRD-001",
+  "bsId": "BS-001",
+  "buildOrder": 64,
+  "executionStatus": "notStarted",
+  "title": "H-1 hardening: deploy-hetzner-server v1.0.0 to v1.0.1 patch train; fixes the nine defects the round-7 real-account gate run d-2026-09-08-010 found; makes the shared throwaway-server fixture consume the same rendered cloud-init the real path consumes",
+  "dependsOnFbsIds": []
+}

package/rcf/fbs/fbs-170.json

@@ -0,0 +1,16 @@
+{
+  "createdAt": "2026-09-08T12:22:31.659Z",
+  "updatedAt": "2026-09-08T14:04:50.163Z",
+  "acIds": [
+    "AC-15001-1",
+    "AC-15001-2"
+  ],
+  "fbsId": "FBS-170",
+  "prdId": "PRD-001",
+  "bsId": "BS-001",
+  "buildOrder": 65,
+  "executionStatus": "notStarted",
+  "title": "H-2 kv re-anchor and observability: five kv probes and README anchored to shipped AC-31xxx band; two previously-uncovered ACs gain runtime observables via facade-round-trip env.CACHE grep and event-secrecy whitelist scan; kv-anatomy test assertions moved with the re-anchor (addendum ruling 1)",
+  "summary": "H-2 kv re-anchor: renumber every anchorAcId in the five contributed kv probes (facade-round-trip, list-with-prefix, cache-aside-hit-then-miss, event-secrecy, real-account-eventual-consistency-smoke) and their header comments from AC-5xxx to the shipped AC-31xxx band; correct the kv README chain-slice pointer paragraph to name US-31101..US-31108; move kv-anatomy test assertions to the new AC-31xxx ids per dispatch addendum ruling 1; add a runtime env.CACHE-grep result on facade-round-trip covering AC-31102-1; add a whitelist-scan result on event-secrecy covering AC-31107-1; the real-account probe carries AC-31103-1 as its bound AC. Two ACs on this FBS: AC-15001-1 (no AC-5xxx string survives on the kv blueprint tree) and AC-15001-2 (every shipped kv AC appears as an anchor on a probe result with a runtime observable).",
+  "dependsOnFbsIds": []
+}

package/rcf/fbs/fbs-171.json

@@ -0,0 +1,16 @@
+{
+  "createdAt": "2026-09-08T12:22:32.025Z",
+  "updatedAt": "2026-09-08T14:04:49.784Z",
+  "acIds": [
+    "AC-15101-1",
+    "AC-15101-2"
+  ],
+  "fbsId": "FBS-171",
+  "prdId": "PRD-001",
+  "bsId": "BS-001",
+  "buildOrder": 66,
+  "executionStatus": "notStarted",
+  "title": "H-2 DO real storage round-trip driver and anchor coverage: real-account-storage-smoke replaces credential-readiness pass-stub with byte-equal put/get round-trip via deployed Worker (or wrangler-dev locally); five previously-unbound DO ACs bound as additional-result anchors on existing probes; DO anatomy test assertions extended for the new bindings",
+  "summary": "H-2 DO storage round-trip driver and anchor coverage: replace the credential-readiness pass-stub in blueprints/platform-cloudflare-durable-objects/contributions/probes/real-account-storage-smoke.mjs with a real HTTP round-trip driver against a deployed Worker route (byte-equal read-back on 1 KiB payload); local proof via the existing wrangler-seam.mjs against miniflare or wrangler dev. Bind the five previously-unbound DO ACs (AC-33106-1, AC-33108-1, AC-33109-1, AC-33110-1, AC-33111-1) as additional-result anchors on the wrangler-seam, storage-round-trip and concurrent-increment probes; add a new probe body inside existing capability only if no existing probe carries the observable honestly. Extend the DO anatomy test to assert the thirteen-AC coverage union. Move the DO probe-body SIMULATE_ branches (sole-reader-scan, storage-round-trip, websocket-hub-broadcast) into fixture-side h2-cf shim modules (Group B scope, tracked by AC-15401-1).",
+  "dependsOnFbsIds": []
+}

package/rcf/fbs/fbs-172.json

@@ -0,0 +1,15 @@
+{
+  "createdAt": "2026-09-08T12:22:32.405Z",
+  "updatedAt": "2026-09-08T14:04:49.404Z",
+  "acIds": [
+    "AC-15201-1"
+  ],
+  "fbsId": "FBS-172",
+  "prdId": "PRD-001",
+  "bsId": "BS-001",
+  "buildOrder": 67,
+  "executionStatus": "notStarted",
+  "title": "H-2 queue real concurrency driver: real-account-concurrency-smoke publishes 500 messages against a live Queues binding on a deployed Worker and asserts concurrent processing up to the documented push-invocation cap; env-absent branch keeps pass-with-skip; queue anatomy test assertions extended",
+  "summary": "H-2 queue real concurrency driver: replace the accountBoundSkipped pass-stub in blueprints/messaging-queue-cloudflare/contributions/probes/real-account-concurrency-smoke.mjs with a real driver that publishes 500 messages through the producer facade wired to a live Queues binding on a deployed Worker (queue name and binding parameterised via env; canonical queue rcf-lite-ci-queue-smoke, HQ supplies values at gate time) and asserts concurrent processing up to the documented push-invocation cap (Cloudflare Queues limits URL). Local proof via miniflare or wrangler dev with local queue simulation. Env-absent branch keeps section 3.5 pass-with-skip. Re-verify the Cloudflare Queues limits URL 200 at merge time and log in the PR provenance. Extend the queue anatomy test to assert the real-account round-trip shape.",
+  "dependsOnFbsIds": []
+}

package/rcf/fbs/fbs-173.json

@@ -0,0 +1,17 @@
+{
+  "createdAt": "2026-09-08T12:22:32.784Z",
+  "updatedAt": "2026-09-08T14:04:49.011Z",
+  "acIds": [
+    "AC-15301-1",
+    "AC-15301-2",
+    "AC-15301-3"
+  ],
+  "fbsId": "FBS-173",
+  "prdId": "PRD-001",
+  "bsId": "BS-001",
+  "buildOrder": 68,
+  "executionStatus": "notStarted",
+  "title": "H-2 tunnel real drivers: connector-healthy runs cloudflared tunnel info against a throwaway hetzner server via T-1 fixture; hostname-routes drives undici + (with Access) two-identity JWT; manifest-schema-validate placeholder becomes fail-with-pointer; tunnel anatomy test assertions extended and the symbolic-anchor ruling recorded",
+  "summary": "H-2 tunnel real drivers: replace blueprints/edge-cloudflare-tunnel/contributions/probes/real-account-connector-healthy.mjs and real-account-tunnel-hostname-routes.mjs warn-on-env stubs with real drivers. connector-healthy provisions the throwaway hetzner server via the T-1 hetzner fixture surface (consumed as-is; hetzner-fixture defects are H-1 scope at HQ), brings a named cloudflared tunnel connector up, runs cloudflared tunnel info <name> through a cloudflared control shim, asserts healthy connector count is at least one, captures tunnelConnectorUp event. hostname-routes drives undici for the public-hostname sub-case and (when CI_HAS_CLOUDFLARE_ACCESS is set) a two-identity JWT sub-case (HQ note: Access is not enabled on the HQ account today, so at gate time the AUD sub-case stays pass-with-skip until HQ enables Access). manifest-schema-validate warn-on-missing-credentials-placeholder becomes fail with a fixture-setup pointer. Tunnel symbolic-anchor ruling (AC-tunnel-*) resolved and recorded in the PR body per brief C4.",
+  "dependsOnFbsIds": []
+}

package/rcf/fbs/fbs-174.json

@@ -0,0 +1,17 @@
+{
+  "createdAt": "2026-09-08T12:22:33.140Z",
+  "updatedAt": "2026-09-08T14:04:48.623Z",
+  "acIds": [
+    "AC-15401-1",
+    "AC-15401-2",
+    "AC-15401-3"
+  ],
+  "fbsId": "FBS-174",
+  "prdId": "PRD-001",
+  "bsId": "BS-001",
+  "buildOrder": 69,
+  "executionStatus": "notStarted",
+  "title": "H-2 cross-cutting probe hygiene: SIMULATE_ branches moved out of shipped probe bodies into fixture-side h2-cf-platform-probe-integrity shims across the four blueprints; committed fail envelope removed and shipped-code pass envelopes committed; probe comments name test doubles honestly; new h2-cf-platform-probe-integrity anatomy test asserts SIMULATE_ purity, envelope hygiene and marker honesty",
+  "summary": "H-2 cross-cutting probe hygiene: SIMULATE_ branches moved out of the shipped probe bodies on the four Cloudflare-platform blueprints (kv: cache-aside-hit-then-miss, event-secrecy; DO: sole-reader-scan, storage-round-trip, websocket-hub-broadcast) into fixture-side shim modules under packages/rcf-lite/test/fixtures/cf-platform/ and .../cf-edge/ whose file names carry the h2-cf-platform-probe-integrity slug prefix (short form h2-cf). Delete the committed fail envelope at .rcf/reports/blueprints/platform-cloudflare-kv/event-secrecy.json and commit a shipped-code pass envelope in its place; regenerate the other kv envelopes and commit shipped-code pass envelopes for the DO/queue/tunnel probes. Rework or adjudicate probe comments flagged by stage-1 marker rows (kv fake clock; DO fake state, fake WebSocket pair; DO probe-utils lines 73 and 75; kv not-yet elicit gating). Add a new h2-cf-platform-probe-integrity anatomy test at packages/rcf-lite/test/blueprint/h2-cf-platform-probe-integrity.test.js that greps the four probe trees for SIMULATE_ (must be zero), walks committed envelopes for fail/warn aggregateVerdict (must be zero), and asserts marker rewording.",
+  "dependsOnFbsIds": []
+}

package/rcf/requirements/req-140.json

@@ -0,0 +1,149 @@
+{
+  "createdAt": "2026-09-08T09:02:25.166Z",
+  "updatedAt": "2026-09-08T09:02:37.052Z",
+  "description": "The object-storage-s3 blueprint gains a Hetzner Object Storage provider value under its shipped v1.0.0 S3-API facade contract. The delta adds an endpoint-shape helper hetzner-endpoint.mjs composing the vendor-documented pattern <bucket>.<location>.your-objectstorage.com from an elicited bucket and location (fsn1 fal, hel1 hel, nbg1 nur per the Hetzner storage overview); a new probe hetzner-object-storage-round-trip.mjs drives put/get/delete against the composed endpoint with accountBound true gated on CI_HAS_HETZNER_OBJECT_STORAGE (records accountBoundSkipped when unset per spec section 3.5); one blueprint-owned REQ (object-storage-s3-REQ-101) and one blueprint-owned US (object-storage-s3-US-28110) anchor the AC AC-28110-1; one blueprint TAC (TAC-2904-object-storage-s3-hetzner-endpoint-helper) formalises the helper contract; one blueprint ADR (ADR-2905-object-storage-s3-hetzner-object-storage-provider, scope local) documents the Hetzner provider value alongside R2, AWS, MinIO with standardsTraceClause Hetzner Object Storage S3 compatibility documented endpoint shape. The existing MinIO local emulator round-trip and R2 real-account smoke stay byte-identical; blueprint bumps 1.0.0 to 1.1.0; rcf-lite package version does NOT bump (spec 8). Chain: HQ round-7 follow-up per HQ chain-block ruling 2026-09-08 (adapter block REQ-140..144, TS-170..174, FBS-160..164, CN-500..509). Section 5.4 of hetzner-round-7-spec-2026-09-07.",
+  "reqId": "REQ-140",
+  "prdId": "PRD-001",
+  "title": "Adapter object-storage-s3 v1.1.0 Hetzner Object Storage: endpoint-shape helper composes <bucket>.<location>.your-objectstorage.com per Hetzner storage overview; delta contributions add hetzner-object-storage-round-trip probe (accountBound gated on CI_HAS_HETZNER_OBJECT_STORAGE); MinIO and R2 paths unchanged",
+  "category": "functional",
+  "domain": "functional",
+  "priority": "must",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [
+      "webUi",
+      "httpApi",
+      "persistence"
+    ],
+    "reason": "keyword-scan",
+    "classifiedAt": "2026-09-08T09:02:25.212Z",
+    "signals": [
+      {
+        "source": "title",
+        "shape": "persistence",
+        "match": "storage"
+      },
+      {
+        "source": "title",
+        "shape": "persistence",
+        "match": "Storage"
+      },
+      {
+        "source": "title",
+        "shape": "httpApi",
+        "match": "endpoint"
+      },
+      {
+        "source": "title",
+        "shape": "persistence",
+        "match": "storage"
+      },
+      {
+        "source": "title",
+        "shape": "persistence",
+        "match": "storage"
+      },
+      {
+        "source": "description",
+        "shape": "persistence",
+        "match": "storage"
+      },
+      {
+        "source": "description",
+        "shape": "persistence",
+        "match": "Storage"
+      },
+      {
+        "source": "description",
+        "shape": "httpApi",
+        "match": "API"
+      },
+      {
+        "source": "description",
+        "shape": "httpApi",
+        "match": "endpoint"
+      },
+      {
+        "source": "description",
+        "shape": "httpApi",
+        "match": "endpoint"
+      },
+      {
+        "source": "description",
+        "shape": "persistence",
+        "match": "storage"
+      },
+      {
+        "source": "description",
+        "shape": "persistence",
+        "match": "storage"
+      },
+      {
+        "source": "description",
+        "shape": "httpApi",
+        "match": "put"
+      },
+      {
+        "source": "description",
+        "shape": "httpApi",
+        "match": "get"
+      },
+      {
+        "source": "description",
+        "shape": "httpApi",
+        "match": "delete"
+      },
+      {
+        "source": "description",
+        "shape": "httpApi",
+        "match": "endpoint"
+      },
+      {
+        "source": "description",
+        "shape": "persistence",
+        "match": "storage"
+      },
+      {
+        "source": "description",
+        "shape": "persistence",
+        "match": "storage"
+      },
+      {
+        "source": "description",
+        "shape": "persistence",
+        "match": "storage"
+      },
+      {
+        "source": "description",
+        "shape": "httpApi",
+        "match": "endpoint"
+      },
+      {
+        "source": "description",
+        "shape": "webUi",
+        "match": "form"
+      },
+      {
+        "source": "description",
+        "shape": "persistence",
+        "match": "storage"
+      },
+      {
+        "source": "description",
+        "shape": "persistence",
+        "match": "storage"
+      },
+      {
+        "source": "description",
+        "shape": "persistence",
+        "match": "Storage"
+      },
+      {
+        "source": "description",
+        "shape": "httpApi",
+        "match": "endpoint"
+      }
+    ]
+  }
+}

package/rcf/requirements/req-145.json

@@ -0,0 +1,53 @@
+{
+  "createdAt": "2026-09-08T10:50:11.871Z",
+  "updatedAt": "2026-09-08T10:50:27.769Z",
+  "description": "H-1 patch train against deploy-hetzner-server 1.0.0 shipped in rcf-lite 0.25.0 (real-account gate d-2026-09-08-010 report). Nine defects; every real-account probe throws before writing the scratch id file so destroy cannot tear the server down. This REQ adds the standing requirement that mocked probes for deploy-hetzner-server consume the same rendered cloud-init user-data the real path consumes (renderer writes the file; mock and real path both read it) and that the rendered user-data carries a real ssh public-key line for the deploy user plus NOPASSWD sudo for that user; that provision.mjs projects snake_case hcloud fields; that destroy.mjs and sweep-orphans.mjs never pass --output json to a delete verb (accepts arrays or objects); that snapshot-verb.mjs shells hcloud server create-image --type snapshot; that ssh baseline checks poll ssh readiness before firing and shell NOPASSWD sudo; and that the manifest ssh-key name is overridable via RCF_LITE_CI_SSH_KEY_NAME. Domain functional. Chain: HQ hardening block H-1 per HQ chain-block ruling 2026-09-08 (REQ-145..149 / TS-175..179 / FBS-165..169 / CN-510..519). Blueprint version 1.0.0 to 1.0.1; every existing contribution id byte-identical.",
+  "reqId": "REQ-145",
+  "prdId": "PRD-001",
+  "title": "Hardening H-1: throwaway-server fixture real-path fidelity for deploy-hetzner-server; provision reads hcloud snake_case; renderer inlines ssh key material; destroy/sweep drop --output json; snapshot verb uses hcloud server create-image; ssh baseline waits for cloud-init and runs under NOPASSWD deploy; sshKeyIds override via RCF_LITE_CI_SSH_KEY_NAME; mock consumes the same rendered cloud-init",
+  "category": "functional",
+  "domain": "functional",
+  "priority": "must",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [
+      "webUi",
+      "httpApi"
+    ],
+    "reason": "keyword-scan",
+    "classifiedAt": "2026-09-08T10:50:11.918Z",
+    "signals": [
+      {
+        "source": "title",
+        "shape": "webUi",
+        "match": "render"
+      },
+      {
+        "source": "title",
+        "shape": "webUi",
+        "match": "rendered"
+      },
+      {
+        "source": "description",
+        "shape": "webUi",
+        "match": "rendered"
+      },
+      {
+        "source": "description",
+        "shape": "webUi",
+        "match": "render"
+      },
+      {
+        "source": "description",
+        "shape": "webUi",
+        "match": "rendered"
+      },
+      {
+        "source": "description",
+        "shape": "httpApi",
+        "match": "delete"
+      }
+    ]
+  }
+}

package/rcf/requirements/req-150.json

@@ -0,0 +1,20 @@
+{
+  "createdAt": "2026-09-08T12:16:28.007Z",
+  "updatedAt": "2026-09-08T12:16:28.158Z",
+  "description": "The rcf-lite platform-cloudflare-kv blueprint ships eight approved user stories (US-31101..US-31108) with nine ACs (AC-31101-1, AC-31102-1, AC-31103-1, AC-31103-2, AC-31104-1, AC-31105-1, AC-31106-1, AC-31107-1, AC-31108-1). Its five contributed probes and the README still anchor the defunct AC-5001..AC-5401 id band that never became chain rows on this repo. This train re-anchors every probe result and the README chain-slice pointers to the shipped AC-31xxx band per Dave ruling 4 (2026-09-08 relay 582c2bca): do NOT resurrect the AC-5xxx stories, move the probes to the shipped band. Every one of the nine shipped kv ACs must appear as an anchor (primary or additional result) on at least one probe with a runtime observable; the two ACs no shipped probe currently covers (AC-31102-1 sole-reader grep, AC-31107-1 whitelist-only lifecycle event scan) are added as additional results on facade-round-trip and event-secrecy per the dispatch addendum. Anatomy-test assertions move with the re-anchor per dispatch addendum ruling 1. No capability change; 0.25.x patch scope; runtime surface unchanged.",
+  "category": "functional",
+  "domain": "functional",
+  "priority": "must",
+  "reqId": "REQ-150",
+  "prdId": "PRD-001",
+  "title": "H-2 kv re-anchor and observability: five kv probes and the README re-anchor from AC-5xxx to the shipped AC-31xxx band; every shipped kv AC gains a runtime observable",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [
+      "none"
+    ],
+    "reason": "keyword-scan",
+    "classifiedAt": "2026-09-08T12:16:28.156Z"
+  }
+}

package/rcf/requirements/req-151.json

@@ -0,0 +1,85 @@
+{
+  "createdAt": "2026-09-08T12:16:28.590Z",
+  "updatedAt": "2026-09-08T12:16:28.726Z",
+  "description": "The rcf-lite platform-cloudflare-durable-objects blueprint ships thirteen ACs (AC-33101-1..AC-33113-1); eight probes anchor AC-33101, 33102, 33103, 33104, 33105, 33107, 33112, 33113, leaving AC-33106-1, AC-33108-1, AC-33109-1, AC-33110-1, AC-33111-1 unbound. real-account-storage-smoke.mjs currently returns pass on credential readiness alone. This train replaces the credential-readiness pass-stub with a real storage round-trip driver: when CI_HAS_CLOUDFLARE_ACCOUNT is set with CF_ACCOUNT_ID, CF_DO_NAMESPACE_ID (or the binding config the driver needs) and CF_API_TOKEN, the probe drives an HTTP round trip against a deployed Worker route that opens the DO facade, writes a fixture key, reads it back, asserts the returned bytes equal the written value. Local proof against miniflare or wrangler dev via the existing wrangler-seam. Env-absent branch keeps the section 3.5 pass-with-skip shape; a pass must never again be reachable from credential presence alone. The five unbound ACs are bound as additional-result anchors on the existing wrangler-seam, storage-round-trip and concurrent-increment probes (or a new probe body inside existing capability if none carries the observable honestly).",
+  "category": "functional",
+  "domain": "functional",
+  "priority": "must",
+  "reqId": "REQ-151",
+  "prdId": "PRD-001",
+  "title": "H-2 DO storage round-trip driver and anchor coverage: real-account-storage-smoke drives a byte-equal put/get through a deployed Worker (or wrangler-dev locally); five previously-unbound DO ACs bound as anchors on existing probes",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [
+      "webUi",
+      "httpApi",
+      "auth",
+      "persistence"
+    ],
+    "reason": "keyword-scan",
+    "classifiedAt": "2026-09-08T12:16:28.724Z",
+    "signals": [
+      {
+        "source": "title",
+        "shape": "persistence",
+        "match": "storage"
+      },
+      {
+        "source": "title",
+        "shape": "persistence",
+        "match": "storage"
+      },
+      {
+        "source": "title",
+        "shape": "httpApi",
+        "match": "put"
+      },
+      {
+        "source": "title",
+        "shape": "httpApi",
+        "match": "get"
+      },
+      {
+        "source": "description",
+        "shape": "persistence",
+        "match": "durable"
+      },
+      {
+        "source": "description",
+        "shape": "persistence",
+        "match": "storage"
+      },
+      {
+        "source": "description",
+        "shape": "auth",
+        "match": "credential"
+      },
+      {
+        "source": "description",
+        "shape": "auth",
+        "match": "credential"
+      },
+      {
+        "source": "description",
+        "shape": "persistence",
+        "match": "storage"
+      },
+      {
+        "source": "description",
+        "shape": "webUi",
+        "match": "route"
+      },
+      {
+        "source": "description",
+        "shape": "auth",
+        "match": "credential"
+      },
+      {
+        "source": "description",
+        "shape": "persistence",
+        "match": "storage"
+      }
+    ]
+  }
+}

package/rcf/requirements/req-152.json

@@ -0,0 +1,20 @@
+{
+  "createdAt": "2026-09-08T12:16:29.086Z",
+  "updatedAt": "2026-09-08T12:16:29.220Z",
+  "description": "The rcf-lite messaging-queue-cloudflare blueprint's real-account-concurrency-smoke.mjs returns verdict pass with accountBoundSkipped true on the account-set branch (the wrangler dev --remote path is unsupported for Queues, so a real-account run must ride a deployed Worker that binds the queue). This train replaces that pass-stub with a real concurrency driver: the account-set branch publishes 500 messages through the producer facade wired to a live Queues binding on a deployed Worker (queue name and binding parameterised via env; HQ supplies values at gate time, canonical queue rcf-lite-ci-queue-smoke) and asserts concurrent processing up to the documented push-invocation cap. Local proof against miniflare or wrangler dev (local queue simulation). The env-absent branch keeps pass-with-skip. The documented Cloudflare Queues limits URL is re-verified 200 at merge time and logged in the PR provenance.",
+  "category": "functional",
+  "domain": "functional",
+  "priority": "must",
+  "reqId": "REQ-152",
+  "prdId": "PRD-001",
+  "title": "H-2 queue real concurrency driver: real-account-concurrency-smoke publishes 500 messages through the producer facade against a live Queues binding on a deployed Worker; concurrent processing asserted against the documented push-invocation cap",
+  "version": "0.1.0",
+  "status": "draft",
+  "shapeClassification": {
+    "shapes": [
+      "none"
+    ],
+    "reason": "keyword-scan",
+    "classifiedAt": "2026-09-08T12:16:29.218Z"
+  }
+}