rcf-lite 0.26.0 → 0.27.0

package/blueprints/deploy-hetzner-server/contributions/user-stories/deploy-hetzner-server-us-37104.json

@@ -13,12 +13,41 @@
       "id": "AC-37104-1",
       "description": "cloud-init-render-lint.mjs renders the template with the fixture manifest and asserts each of the six baseline blocks (SSH key-only, root disabled, UFW default-deny incoming, DOCKER-USER iptables chain, fail2ban SSH jail, unattended-upgrades) appears in the rendered YAML by grep; a mutation SIMULATE_HARDENING_DRIFT=true removes the unattended-upgrades block and the probe FAILS with a message naming the missing line.",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
+    },
+    {
+      "id": "AC-37104-2",
+      "description": "Malformed template refusal. Given the cloud-init template with a placeholder tag left unclosed or misspelled, when cloud-init-render-lint.mjs renders it, then the probe FAILS naming the malformed placeholder; no rendered YAML is written to disk.",
+      "given": "a cloud-init template with a malformed placeholder",
+      "when": "cloud-init-render-lint.mjs runs",
+      "then": "the probe FAILS naming the malformed placeholder; no rendered YAML is written",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-3803-deploy-hetzner-server-cloud-init-template",
+        "field": "interfaces.cloud-init.yaml.tmpl"
+      },
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-37104-3",
+      "description": "Fixture renderer refuses on unknown placeholder. Given the fixture renderer given a template with an unknown placeholder tag (a tag not in the two-placeholder shape {{name}} and {{sshAuthorizedKeysBlock}}), when the renderer runs, then it refuses with a named error kind (unknownPlaceholder); no rendered YAML is written to disk.",
+      "given": "a template with an unknown placeholder tag",
+      "when": "the fixture renderer runs",
+      "then": "the renderer refuses with unknownPlaceholder; no rendered YAML is written",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-3803-deploy-hetzner-server-cloud-init-template",
+        "field": "interfaces.cloud-init.yaml.tmpl"
+      },
+      "disposition": "fixed"
     }
   ],
   "tacIds": [
     "TAC-3803-deploy-hetzner-server-cloud-init-template"
   ],
   "createdAt": "2026-09-08T00:00:00.000Z",
-  "updatedAt": "2026-09-08T00:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/deploy-hetzner-server/contributions/user-stories/deploy-hetzner-server-us-37105.json

@@ -13,12 +13,35 @@
       "id": "AC-37105-1",
       "description": "real-account-cloud-init-hardened.mjs (accountBound: true, skipped without CI_HAS_HETZNER_ACCOUNT) waits for cloud-init status --wait on the throwaway server, then ssh-checks the six baseline blocks and asserts each check passes; failure names the missing block. Teardown via destroy.mjs runs regardless.",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-3803-deploy-hetzner-server-cloud-init-template",
+        "field": "interfaces.cloud-init.yaml.tmpl"
+      },
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://cloudinit.readthedocs.io/en/latest/topics/format.html",
+        "verifiedOn": "2026-09-09"
+      }
+    },
+    {
+      "id": "AC-37105-2",
+      "description": "Cloud-init timeout surfaces as a probe failure. Given the cloud-init boot process exceeds the vendor timeout (approximately 10 minutes), when cloud-init status --wait returns a non-done status, then the probe FAILS naming the non-done status; the throwaway server is torn down via destroy.mjs regardless.",
+      "given": "cloud-init boot exceeds the vendor timeout",
+      "when": "cloud-init status --wait returns non-done",
+      "then": "the probe FAILS naming the non-done status; teardown via destroy.mjs runs regardless",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-3803-deploy-hetzner-server-cloud-init-template",
+        "field": "interfaces.cloud-init.yaml.tmpl"
+      },
+      "disposition": "fixed"
     }
   ],
   "tacIds": [
     "TAC-3803-deploy-hetzner-server-cloud-init-template"
   ],
   "createdAt": "2026-09-08T00:00:00.000Z",
-  "updatedAt": "2026-09-08T00:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/deploy-hetzner-server/contributions/user-stories/deploy-hetzner-server-us-37106.json

@@ -13,7 +13,40 @@
       "id": "AC-37106-1",
       "description": "manifest-schema-validate.mjs asserts every fixture manifest carries a firewallRules array matching the shape (22 permitted only from a nonempty list of source-prefix ranges with no 0.0.0.0/0; 80 and 443 permitted from 0.0.0.0/0; no other inbound rule); an induced defect (a manifest that opens 22 to 0.0.0.0/0) FAILS schema validation with a message naming the offending rule.",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-3804-deploy-hetzner-server-firewall-shape",
+        "field": "interfaces.firewallRules"
+      },
+      "disposition": "template"
+    },
+    {
+      "id": "AC-37106-2",
+      "description": "Firewall applied at provision time. Given a manifest carrying the shape-valid firewallRules array, when the provisioner runs createServer + applyFirewall, then hcloud firewall list --output json shows a firewall bound to the new server whose rules match the manifest shape (ssh restricted, 80/443 open, all else denied); a mutation SIMULATE_FIREWALL_DRIFT=true edits one rule out-of-band and the probe FAILS naming the drifted rule.",
+      "given": "a manifest with shape-valid firewallRules and no pre-existing firewall bound",
+      "when": "the provisioner runs against the throwaway account",
+      "then": "hcloud firewall list shows the bound firewall matching the manifest; a drift mutation FAILS the probe naming the drifted rule",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-3804-deploy-hetzner-server-firewall-shape",
+        "field": "interfaces.firewallRules"
+      },
+      "disposition": "template"
+    },
+    {
+      "id": "AC-37106-3",
+      "description": "Reuse existing firewall-id path. Given the elicited firewall-id names an existing Hetzner Cloud firewall id, when the provisioner runs createServer, then it attaches the existing firewall (no new firewall is created), and hcloud firewall list --output json shows no duplicate; a mutation that supplies a firewall-id absent from the account FAILS provision with a named error kind (missingFirewallId).",
+      "given": "firewall-id names an existing account firewall id",
+      "when": "the provisioner runs createServer",
+      "then": "the existing firewall attaches; no new firewall is created; the missing-id mutation FAILS provision with missingFirewallId",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-3801-deploy-hetzner-server-provisioner",
+        "field": "interfaces.default"
+      },
+      "disposition": "template"
     }
   ],
   "tacIds": [
@@ -21,5 +54,5 @@
     "TAC-3804-deploy-hetzner-server-firewall-shape"
   ],
   "createdAt": "2026-09-08T00:00:00.000Z",
-  "updatedAt": "2026-09-08T00:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/deploy-hetzner-server/contributions/user-stories/deploy-hetzner-server-us-37107.json

@@ -13,12 +13,41 @@
       "id": "AC-37107-1",
       "description": "manifest-schema-validate.mjs asserts every fixture manifest carries snapshotCadence with a value in the shipped enum {weekly, daily, off}; a manifest missing the field FAILS schema validation naming the missing field.",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
+    },
+    {
+      "id": "AC-37107-2",
+      "description": "Scheduled snapshot fires per elicited cadence. Given snapshotCadence = weekly and hetznerManagedBackups = false, when the scheduled snapshot runner ticks past the weekly boundary against the throwaway server, then hcloud image list --type=snapshot --output json shows a fresh snapshot tagged with the server name and current wall-clock time; hetznerScheduledSnapshotTaken fires on the event sink with snapshot id, cadence and time. A mutation snapshotCadence = off suppresses the scheduled run and asserts no new snapshot appears.",
+      "given": "snapshotCadence = weekly, hetznerManagedBackups = false, throwaway server present",
+      "when": "the scheduled snapshot runner ticks past the weekly boundary",
+      "then": "hcloud image list --type=snapshot shows a fresh tagged snapshot; hetznerScheduledSnapshotTaken fires with snapshot id, cadence, time; snapshotCadence=off produces no new snapshot",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-3801-deploy-hetzner-server-provisioner",
+        "field": "interfaces.default"
+      },
+      "disposition": "template"
+    },
+    {
+      "id": "AC-37107-3",
+      "description": "Enum drift refusal on snapshot-cadence. Given a manifest snapshotCadence value outside the shipped enum {weekly, daily, off}, when manifest-schema-validate.mjs runs, then the probe FAILS naming the offending value and the shipped enum; the provisioner refuses to apply the manifest.",
+      "given": "snapshotCadence value outside {weekly, daily, off}",
+      "when": "manifest-schema-validate.mjs runs",
+      "then": "the probe FAILS naming the offending value and the shipped enum; the provisioner refuses to apply",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-3802-deploy-hetzner-server-manifest-schema",
+        "field": "interfaces.hetzner-server.schema.json"
+      },
+      "disposition": "template"
     }
   ],
   "tacIds": [
     "TAC-3802-deploy-hetzner-server-manifest-schema"
   ],
   "createdAt": "2026-09-08T00:00:00.000Z",
-  "updatedAt": "2026-09-08T00:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/deploy-hetzner-server/contributions/user-stories/deploy-hetzner-server-us-37108.json

@@ -13,12 +13,53 @@
       "id": "AC-37108-1",
       "description": "real-account-snapshot-on-demand.mjs (accountBound: true, skipped without CI_HAS_HETZNER_ACCOUNT) fires the snapshot verb on the throwaway server, then asserts hcloud image list --type=snapshot --output json shows a snapshot tagged with the server name and current wall-clock time; hetznerSnapshotTaken event carries snapshot id and time. Teardown via destroy.mjs.",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://docs.hetzner.cloud/#images-create-image-from-a-server",
+        "verifiedOn": "2026-09-09"
+      }
+    },
+    {
+      "id": "AC-37108-2",
+      "description": "Snapshot-on-demand upstream failure. Given the hetzner API returns a non-2xx response on hcloud image create-image (for example 429 rate-limited or 503 upstream), when the snapshot-on-demand verb runs, then the facade emits provisionerFailed with { verb: \"createImage\", apiStatus, retryable } on the event sink and no hetznerSnapshotTaken fires; no orphan snapshot resource remains on the account.",
+      "given": "the hetzner API returns 429 or 503 on hcloud image create-image",
+      "when": "the snapshot-on-demand verb runs",
+      "then": "the facade emits provisionerFailed with { verb, apiStatus, retryable }; no hetznerSnapshotTaken fires; no orphan snapshot remains",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-3801-deploy-hetzner-server-provisioner",
+        "field": "interfaces.default"
+      },
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://docs.hetzner.cloud/#errors",
+        "verifiedOn": "2026-09-09"
+      }
+    },
+    {
+      "id": "AC-37108-3",
+      "description": "Snapshot payload shape check. Given a successful snapshot-on-demand, when the hetznerSnapshotTaken event record is inspected, then the record carries exactly { serverName, snapshotId, ts } (ts is wall-clock milliseconds since epoch) and no additional field; a mutation SIMULATE_SNAPSHOT_EVENT_LEAK=true injects a token substring into the record and the sink observer FAILS.",
+      "given": "a successful snapshot-on-demand event fired",
+      "when": "the record is inspected",
+      "then": "the record carries exactly {serverName, snapshotId, ts} and no additional field; the leak mutation FAILS",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-3801-deploy-hetzner-server-provisioner",
+        "field": "interfaces.default"
+      },
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://docs.hetzner.cloud/#images-create-image-from-a-server",
+        "verifiedOn": "2026-09-09"
+      }
     }
   ],
   "tacIds": [
     "TAC-3801-deploy-hetzner-server-provisioner"
   ],
   "createdAt": "2026-09-08T00:00:00.000Z",
-  "updatedAt": "2026-09-08T00:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/deploy-hetzner-server/contributions/user-stories/deploy-hetzner-server-us-37109.json

@@ -13,12 +13,41 @@
       "id": "AC-37109-1",
       "description": "hcloud-dry-run-mock.mjs drives every lifecycle event through the facade against a mocked hcloud shim; the accumulated event stream carries only the metadata fields named on REQ-006; a mutation SIMULATE_EVENT_SECRECY_LEAK=true injects the token into the hetznerServerProvisioned payload and the probe FAILS with a defensive-fake finding naming the leaked field.",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-37109-2",
+      "description": "Secret exclusion by grep-across-source. Given the fixture provisioner source and the fixture renderer source (per TAC-3803), when a source-tree scan searches every onEvent call site and every event-record construction site for the substring HETZNER_ACCOUNT_API_KEY and any ssh key body, then no match is found; a mutation SIMULATE_EVENT_TOKEN_LEAK=true adds the token into an event field and the probe FAILS naming the leaked field.",
+      "given": "the fixture provisioner and renderer source, and the four documented lifecycle events",
+      "when": "a source-tree grep runs across every event-record construction site",
+      "then": "no HETZNER_ACCOUNT_API_KEY or ssh-key-body match is found; the mutation FAILS naming the leaked field",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-3801-deploy-hetzner-server-provisioner",
+        "field": "interfaces.default"
+      },
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-37109-3",
+      "description": "Event fires once per lifecycle moment (repeat-run idempotency). Given a completed provision and a completed destroy, when the run replays a second time against the same manifest and account, then hetznerServerProvisioned fires once per successful create and hetznerServerDestroyed fires once per successful destroy; no duplicate event fires for a run whose upstream call did not change resource state.",
+      "given": "a completed provision + destroy cycle",
+      "when": "the run replays a second time against the same manifest and account",
+      "then": "each lifecycle event fires exactly once per successful state change; no duplicate event fires on a no-op call",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-3801-deploy-hetzner-server-provisioner",
+        "field": "interfaces.default"
+      },
+      "disposition": "template"
     }
   ],
   "tacIds": [
     "TAC-3801-deploy-hetzner-server-provisioner"
   ],
   "createdAt": "2026-09-08T00:00:00.000Z",
-  "updatedAt": "2026-09-08T00:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/deploy-hetzner-server/docs/topics.md

@@ -44,5 +44,5 @@ The shelf-wide band registry lives in `packages/rcf-lite/docs/blueprint-authorin
 
 - `security-secrets-management` (v1.0.1): the provisioner facade reads `HETZNER_ACCOUNT_API_KEY` through the applied secrets facade. The facade is the sole reader; every other module in the applying project imports the facade and never dereferences the token.
 - `deploy-cloudflare-workers` (v1.2.0): sibling in the `deploy-*` family. The family enforces one-target-per-project at apply time (a project applying both refuses with `deploy-family-multiple-targets`).
-- Round-7 T-2 `platform-docker-compose-host`: composes on `capabilities: [cloudHost]`; ships the compose runtime on the Hetzner host this blueprint provisions.
-- Round-7 T-3 `edge-cloudflare-tunnel`: composes on `cloudHost` (systemd unit shape) or on `containerHost` (compose service shape); either shape bridges the Hetzner host to the Cloudflare edge without opening origin ports.
+- round-7 `platform-docker-compose-host`: composes on `capabilities: [cloudHost]`; ships the compose runtime on the Hetzner host this blueprint provisions.
+- round-7 `edge-cloudflare-tunnel`: composes on `cloudHost` (systemd unit shape) or on `containerHost` (compose service shape); either shape bridges the Hetzner host to the Cloudflare edge without opening origin ports.

package/blueprints/deploy-hetzner-server/guide/deploy-hetzner-server.md

@@ -29,14 +29,14 @@ is the canonical example. Copy it and edit:
 
 ```jsonc
 {
-  "name": "ops-01",
+  "name": "ops-host",
   "serverType": "cx33",
   "location": "fsn1",
   "image": "ubuntu-24.04",
-  "sshKeyIds": ["dave-ed25519", "baz-yubikey"],
+  "sshKeyIds": ["primary-admin-ed25519", "backup-admin-yubikey"],
   "networkId": null,
   "firewallId": null,
-  "cloudInitPath": "hetzner/servers/rendered/ops-01.cloud-init.yaml",
+  "cloudInitPath": "hetzner/servers/rendered/ops-host.cloud-init.yaml",
   "labels": {
     "role": "ops-host",
     "blueprint": "deploy-hetzner-server"
@@ -106,7 +106,7 @@ elicit change.
 ## When to reach for `cx23` vs `cx33`
 
 - `cx23` (default). Two vCPU, 4 GB RAM, 40 GB SSD. Approximately
-  EUR 4.15/month. Fine for the docker-compose stack that ops-01
+  EUR 4.15/month. Fine for the docker-compose stack that ops-host
   runs (fewer than ten containers, each below 300 MB RSS).
 - `cx33`. Two vCPU, 8 GB RAM, 80 GB SSD. Approximately EUR
   7.99/month. Reach when the compose stack holds a Postgres, a
@@ -143,7 +143,7 @@ https://docs.hetzner.com/cloud/servers/backups-snapshots/overview.
 Fire a snapshot manually from the applying project's CLI:
 
 ```
-node ./scripts/snapshot.mjs --server ops-01
+node ./scripts/snapshot.mjs --server ops-host
 ```
 
 The script imports the provisioner facade, calls `takeSnapshot`,
@@ -159,15 +159,16 @@ ceiling: EUR 0.006/hour per run; destroy runs in `always()`; nightly
 `sweep-orphans` cron collects any leak on a 60-minute label-age
 cutoff.
 
-Round-7 T-2 (`platform-docker-compose-host`) and T-3
-(`edge-cloudflare-tunnel`) EXTEND this fixture rather than shipping
-a second copy. T-2 mounts the docker + compose verbs on the same
-throwaway server after cloud-init seals the baseline; T-3 mounts
-`cloudflared` on the runtime T-2 stands up.
+Round-7 `platform-docker-compose-host` and
+`edge-cloudflare-tunnel` EXTEND this fixture rather than shipping
+a second copy. The container-host blueprint mounts the docker + compose
+verbs on the same throwaway server after cloud-init seals the baseline;
+the edge-tunnel blueprint mounts `cloudflared` on the runtime the
+container-host stack stands up.
 
 ## Standards trace
 
-Every URL fetched 200 in the ratifying pass before the T-1 PR.
+Every URL fetched 200 in the ratifying pass before the PR.
 
 - Hetzner Cloud API https://docs.hetzner.cloud/
 - Hetzner Cloud CLI https://github.com/hetznercloud/cli

package/blueprints/edge-cloudflare-access/CHANGELOG.md

@@ -1,6 +1,38 @@
 # Changelog
 
+## 1.1.3 - 2026-09-10
+
+Positive-evidence rule alignment on the probe pack skip path (authoring standard section 7d); register tidy in shipped prose (no capability change).
+
+- Probes and fixture: the account-bound skip return on `contributions/probes/real-account-gated-url.mjs` now carries a `reason` field naming the exact env var(s) that were unset; the same fixture README (`packages/rcf-lite/test/fixtures/cf-edge/README.md`) gains a "Declared env vars" section covering the access-side env-var surface, per authoring standard section 7d. Skip-path probe reports regenerated so the shipped shape carries the new field.
+- Closes F-8: README compose bullet and consumer note stripped of internal pattern label.
+- Closes F-9: REQ-006 description stripped of internal mechanism label.
+
+## 1.1.2 - 2026-09-10
+
+Single-mechanism story legality notes; owner reference for the audit-record shape.
+
+- Appended the section 7a legality note to AC-34101-1, AC-34105-1, AC-34106-1, AC-34108-1, AC-34109-1 and AC-34110-1 recording that each single-AC story's mechanism has no additional documented failure path in the guide or the anchored TAC (adjacent failure paths are owned by sibling stories, not by these).
+- Rewrote REQ-004 description to reference the owning TAC field (`TAC-3501-edge-cloudflare-access-jwt-validator.responsibilities[2]`) for the audit-record shape, rather than restating the shape verbatim.
+
+## 1.1.1 (register-sweep patch, 2026-09-10)
+
+- Register: neutral wording in shipped prose (no capability change).
+
+## 1.1.0 - 2026-09-09
+
+hardening pass edge (criterion a REQ-layer backing; criterion b AC-set sufficiency; criterion c chain consistency lint-zero on pass 1 and pass 2).
+
+- Added REQ-007 and US-34110: the shipped guide names, per policy-shape option, the required dashboard-owned inputs (email domain, group name, identity provider, application-vs-path scope) and every shipped elicit alongside its runtime effect (closes F-1).
+- Added failure-path ACs to US-34102 (AC-34102-2..5 close F-2: wrong audience, malformed JWT, unknown kid after refresh, JWKS-unavailable fail-closed); US-34104 (AC-34104-2..3 close F-3: neither and both application identifiers refuse apply); US-34107 (AC-34107-2..5 close F-4: break-glass disabled, wrong id, wrong secret via constant-time compare, and partial-pair fall-through).
+- Every REQ now carries `deliveredBy`; every AC carries `disposition`; ACs referencing owner-owned literals carry `ownerRef`.
+- De-identified in-house references in US-34109.
+- Chain-consistency lint reports 0 findings on both passes.
+
+
 All notable changes to `edge-cloudflare-access` are recorded here. The shape follows Keep a Changelog and Semantic Versioning per the blueprint authoring standard.
+- Review fix pass (2026-09-09): split US-34103 into canonical-pass and SIMULATE_NON_VALIDATOR_HEADER-fail ACs, each with a concrete oracle (probe verdict + named field) and an `ownerRef` into TAC-3501. Re-marked ACs per section 7b: mechanism-invariant refusal reasons (`aud-mismatch`, `jwt-malformed`, `kid-unknown`, `jwks-unavailable`, `bypass-id-mismatch`, `bypass-secret-mismatch`, `jwt-missing`), audit-record shapes, guide-section presence assertions and the JWT validator happy path stay `fixed`; US-34104 AC-34104-1 (elicit shape recording), US-34107 AC-34107-1/-3/-4/-5 (bypass id/secret pair) and US-34109 AC-34109-1 (CF_ACCESS_HOST) re-marked `template` naming the values the applying agent sets (access-application-host or access-selfhosted-app-id, access-audience, access-jwks-url, access-policy-shape enum, access-bypass-service-auth-id + paired secret, CF_ACCESS_HOST). Vendor citations added on US-34101 (Cf-Access-Jwt-Assertion header), US-34105 (Zero Trust dashboard docs), US-34107 AC-34107-1 (service-tokens docs) and US-34109 (Access policies docs). Genuinely single-mechanism stories (US-34101, US-34105, US-34106, US-34108, US-34109, US-34110) carry the section-7a note inside the story `description` field, not in a schema-illegal new field.
+
 
 ## 1.0.0 (2026-09-07)
 
@@ -11,13 +43,13 @@ All notable changes to `edge-cloudflare-access` are recorded here. The shape fol
 - 6 Node-only probes under `contributions/probes/`: `jwt-validator-fixture` (fixture-signed JWT validates and principal reduces to `{email, sub, groups}` on request.auth), `jwt-validator-reject` (three subcases: missing header, expired exp, mis-signed each return 401 with one metadata-only audit event), `admin-console-gate-surface` (extended admin-console fixture flips its sign-in surface per applied capability set; covers `AC-34108-1`), `audit-event-secrecy` (5 pass + 5 reject runs produce 10 metadata-only records with no forbidden substrings, no token slices, no header names beyond `path`), `real-account-gated-url` (`accountBound: true`; records `accountBoundSkipped: true` in CI without `CI_HAS_CLOUDFLARE_ACCOUNT` per spec section 3.5) and `wrangler-seam` (drives `wrangler dev --local` on the fixture; `/protected` returns HTTP 401 on the shipped validator's missing-header reject path; `/health` returns HTTP 200 exempt; warn semantics per section 3.1 pass-with-skip if wrangler is missing or fails to bind).
 - 6 elicited parameters on `blueprint.json`: `access-application-host` (or `access-selfhosted-app-id`, exactly one required), `access-audience`, `access-jwks-url`, `access-policy-shape` (enum default `email-domain`), `access-bypass-service-auth-id` (blank disables break-glass).
 - `suggestedCompanions`: `logging` (for the metadata-only audit sink retention), `errorHandling` (for the validator failure boundary) and `secretsManagement` (for the paired break-glass service-auth secret).
-- Ships the shared `cf-edge` sample-app fixture at `packages/rcf-lite/test/fixtures/cf-edge/` (T-4 mints it per spec section 3.3). The fixture ships the applied Worker (`src/index.mjs`), the JWT validator (`src/jwt-validator.mjs`, sole reader of the `Cf-Access-Jwt-Assertion` header), a dependency-free RS256 fixture-JWT signer (`test/jwt-signer.mjs`) and a local JWKS server (`test/jwks-server.mjs`). No new rcf-lite runtime dependency (Node's built-in `crypto` module signs and verifies).
+- Ships the shared `cf-edge` sample-app fixture at `packages/rcf-lite/test/fixtures/cf-edge/` (mints it per spec section 3.3). The fixture ships the applied Worker (`src/index.mjs`), the JWT validator (`src/jwt-validator.mjs`, sole reader of the `Cf-Access-Jwt-Assertion` header), a dependency-free RS256 fixture-JWT signer (`test/jwt-signer.mjs`) and a local JWKS server (`test/jwks-server.mjs`). No new rcf-lite runtime dependency (Node's built-in `crypto` module signs and verifies).
 - Extends `packages/rcf-lite/test/fixtures/probe-pack-application-admin-console/` with a `/admin/sign-in` route rendering the Access-gated surface (with `?caps=zeroTrustGate`) or the local-login surface (without). The extension rides `application-admin-console` v1.1.0.
-- Anatomy test at `packages/rcf-lite/test/blueprint/edge-cloudflare-access-anatomy.test.js` covers `TS-110..119` on the T-4 chain slice (blueprint shape, contributions cross-check, JWT validator behaviour, sole-reader guarantee, audit-event secrecy, break-glass posture, admin-console composition, fixture files, ADR bodies and clauses, guide sections and vendor URL).
+- Anatomy test at `packages/rcf-lite/test/blueprint/edge-cloudflare-access-anatomy.test.js` covers `TS-110..119` on the chain slice (blueprint shape, contributions cross-check, JWT validator behaviour, sole-reader guarantee, audit-event secrecy, break-glass posture, admin-console composition, fixture files, ADR bodies and clauses, guide sections and vendor URL).
 
 ### Known limitations
 
 - The `real-account-gated-url` probe records `accountBoundSkipped: true` and aggregates to `pass` when `CI_HAS_CLOUDFLARE_ACCOUNT` or `CF_ACCESS_HOST` are unset (spec section 3.5 pass-with-skip). Full mechanism reach requires a CI environment with both env vars set and a deployed hostname behind an issued Zero Trust policy.
 - The v1.0.0 boundary defers per-path policy scope authoring, group-membership rule authoring and identity-provider federation to v1.1.0. The shipped validator observes the JWT's `groups` claim but does not enforce policy on it (the Cloudflare edge enforces before the request reaches the origin Worker); a future minor could ship a group-membership refinement.
-- The `wrangler-seam` probe warns (never fails) when `wrangler` is not installed under `packages/rcf-lite/test/fixtures/cf-edge/node_modules/.bin/wrangler`; a handler thrown at the workerd boundary is a genuine fail per the round-6 T-3 gate directive.
+- The `wrangler-seam` probe warns (never fails) when `wrangler` is not installed under `packages/rcf-lite/test/fixtures/cf-edge/node_modules/.bin/wrangler`; a handler thrown at the workerd boundary is a genuine fail per the round-6 gate directive.
 - The Access-gated sign-in surface on `application-admin-console` v1.1.0 shows a placeholder principal email in the fixture (supplied via `?principalEmail=` or `ADMIN_CONSOLE_PRINCIPAL_EMAIL` env var). In a real deployment the principal reads from `request.auth.email` the JWT validator attaches; the fixture does not embed the validator (it renders the surface).

package/blueprints/edge-cloudflare-access/README.md

@@ -22,7 +22,7 @@ value beyond `path` ever leaves the validator boundary.
   vendor-neutral seam (`request.auth`) between the edge and the
   downstream handler.
 - Compose with `application-admin-console` v1.1.0 for the Access-gated
-  sign-in surface (round-4 T-4 capability-minor pattern).
+  sign-in surface.
 
 ## The six REQs
 
@@ -138,4 +138,4 @@ Each probe prints a report envelope and writes it to
   optionally: the admin-console's sign-in surface renders
   Access-gated when `zeroTrustGate` is in the applied set (and
   falls back to `security-auth-*` local login otherwise). The
-  v1.1.0 minor rides this PR (round-4 T-4 capability-minor pattern).
+  v1.1.0 minor rides this PR.

package/blueprints/edge-cloudflare-access/blueprint.json

@@ -1,6 +1,6 @@
 {
   "slug": "edge-cloudflare-access",
-  "version": "1.0.0",
+  "version": "1.1.3",
   "category": "edge",
   "capabilities": [
     "zeroTrustGate"
@@ -192,6 +192,16 @@
       "recommendedDefault": true,
       "elicited": false,
       "standardsTraceClause": "generic enterprise practice"
+    },
+    {
+      "id": "edge-cloudflare-access-REQ-007",
+      "kind": "req",
+      "path": "requirements/edge-cloudflare-access-req-007.json"
+    },
+    {
+      "id": "edge-cloudflare-access-US-34110",
+      "kind": "us",
+      "path": "user-stories/edge-cloudflare-access-us-34110.json"
     }
   ]
-}
+}

package/blueprints/edge-cloudflare-access/contributions/probes/real-account-gated-url.mjs

@@ -29,14 +29,22 @@ export default async function runProbe() {
   const has = process.env.CI_HAS_CLOUDFLARE_ACCOUNT === 'true';
   const host = process.env.CF_ACCESS_HOST || '';
   if (!has || !host) {
+    // Positive-evidence rule (authoring standard section 7d): the skip
+    // record names the exact env var(s) that were unset in `reason`,
+    // so a `pass` verdict is legal without positive evidence.
+    const unset = [];
+    if (!has) unset.push('CI_HAS_CLOUDFLARE_ACCOUNT');
+    if (!host) unset.push('CF_ACCESS_HOST');
+    const reason = unset.join(', ');
     return {
       results: [{
         anchorAcId: 'AC-34109-1',
         verdict: 'pass',
         accountBoundSkipped: true,
-        detail: `accountBoundSkipped: CI_HAS_CLOUDFLARE_ACCOUNT=${has} CF_ACCESS_HOST=${host ? 'set' : 'unset'}; per spec section 3.5 pass-with-skip.`,
+        reason,
+        detail: `accountBoundSkipped: ${reason} unset; per spec section 3.5 pass-with-skip.`,
       }],
-      extra: { accountBoundSkipped: true },
+      extra: { accountBoundSkipped: true, reason },
     };
   }
   try {

package/blueprints/edge-cloudflare-access/contributions/probes/wrangler-seam.mjs

@@ -18,7 +18,7 @@
 // Warn semantics per spec section 3.1 pass-with-skip:
 //   - wrangler devDependency missing: aggregateVerdict warn (never fail);
 //   - wrangler CLI fails to bind within the cap: warn.
-//   - A handler thrown at the workerd boundary: fail (per round-6 T-3 gate).
+//   - A handler thrown at the workerd boundary: fail (per round-6 gate).
 //
 // Mutation-check pair for the negative fires: removing the
 // validator's early-return call on missing header would surface

package/blueprints/edge-cloudflare-access/contributions/requirements/edge-cloudflare-access-req-001.json

@@ -13,5 +13,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-07T16:00:00.000Z",
-  "updatedAt": "2026-09-07T16:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00.000Z",
+  "deliveredBy": {
+    "tacId": "TAC-3501-edge-cloudflare-access-jwt-validator",
+    "field": "interfaces.createAccessValidator"
+  }
 }

package/blueprints/edge-cloudflare-access/contributions/requirements/edge-cloudflare-access-req-002.json

@@ -13,5 +13,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-07T16:00:00.000Z",
-  "updatedAt": "2026-09-07T16:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00.000Z",
+  "deliveredBy": {
+    "tacId": "TAC-3502-edge-cloudflare-access-application-declaration",
+    "field": "responsibilities.applicationDeclaration"
+  }
 }

package/blueprints/edge-cloudflare-access/contributions/requirements/edge-cloudflare-access-req-003.json

@@ -13,5 +13,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-07T16:00:00.000Z",
-  "updatedAt": "2026-09-07T16:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00.000Z",
+  "deliveredBy": {
+    "tacId": "TAC-3503-edge-cloudflare-access-policy-shape",
+    "field": "responsibilities.policyIssueGuide"
+  }
 }

package/blueprints/edge-cloudflare-access/contributions/requirements/edge-cloudflare-access-req-004.json

@@ -2,7 +2,7 @@
   "reqId": "edge-cloudflare-access-REQ-004",
   "prdId": "PRD-001",
   "title": "The audit event carries only metadata fields (email, outcome, timestamp, path) with no token value and no header names beyond path",
-  "description": "Every validate-pass, validate-reject and bypass emits exactly one audit event on the injected sink with the metadata-only shape {email, outcome, timestamp, path}. The record is Object.frozen at the validator boundary so no downstream module can enrich it with a stray token slice or header value. The serialised JSON of every record contains no substring of the JWT (header, payload or signature), no Authorization value, and no header names beyond path.",
+  "description": "Every validate-pass, validate-reject and bypass emits exactly one audit event on the injected sink with the metadata-only record shape named on `TAC-3501-edge-cloudflare-access-jwt-validator.responsibilities[2]`. The record is Object.frozen at the validator boundary so no downstream module can enrich it with a stray token slice or header value. The serialised JSON of every record contains no substring of the JWT (header, payload or signature), no Authorization value, and no header names beyond the field the TAC owner names.",
   "category": "functional",
   "domain": "edge",
   "priority": "must",
@@ -13,5 +13,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-07T16:00:00.000Z",
-  "updatedAt": "2026-09-07T16:00:00.000Z"
+  "updatedAt": "2026-09-10T00:00:00.000Z",
+  "deliveredBy": {
+    "tacId": "TAC-3504-edge-cloudflare-access-audit-sink",
+    "field": "responsibilities.metadataOnlyRecord"
+  }
 }

package/blueprints/edge-cloudflare-access/contributions/requirements/edge-cloudflare-access-req-005.json

@@ -13,5 +13,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-07T16:00:00.000Z",
-  "updatedAt": "2026-09-07T16:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00.000Z",
+  "deliveredBy": {
+    "tacId": "TAC-3501-edge-cloudflare-access-jwt-validator",
+    "field": "responsibilities.breakGlassPath"
+  }
 }

package/blueprints/edge-cloudflare-access/contributions/requirements/edge-cloudflare-access-req-006.json

@@ -2,11 +2,11 @@
   "reqId": "edge-cloudflare-access-REQ-006",
   "prdId": "PRD-001",
   "title": "Composition with application-admin-console v1.1.0: the sign-in surface flips per applied capability set",
-  "description": "When application-admin-console v1.1.0 is applied alongside edge-cloudflare-access, the admin-console reads the appliedCapabilities set at apply-time (via the shipped readAppliedCapabilities helper, the T-5 visual-round mechanism); with zeroTrustGate in the set the admin-console renders the Access-gated sign-in surface (data-surface=access-gated, no [data-surface=local-login], a [data-role=principal-read] with the request.auth email); without zeroTrustGate the admin-console falls back to whatever security-auth-* is applied (data-surface=local-login). The composition is deterministic; the pack check AC-21815-1 on the shipped application-admin-console.pack.mjs enforces the gated branch.",
+  "description": "When application-admin-console v1.1.0 is applied alongside edge-cloudflare-access, the admin-console reads the appliedCapabilities set at apply-time (via the shipped readAppliedCapabilities helper); with zeroTrustGate in the set the admin-console renders the Access-gated sign-in surface (data-surface=access-gated, no [data-surface=local-login], a [data-role=principal-read] with the request.auth email); without zeroTrustGate the admin-console falls back to whatever security-auth-* is applied (data-surface=local-login). The composition is deterministic; the pack check AC-21815-1 on the shipped application-admin-console.pack.mjs enforces the gated branch.",
   "category": "functional",
   "domain": "edge",
   "priority": "must",
-  "rationale": "Ratified in the Cloudflare round 6 spec (2026-09-06 section 5.4 plus section 5.4.1 admin-console v1.1.0 delta; spec section 1 ruling 7). Ships as v1.0.0 of edge-cloudflare-access and v1.1.0 of application-admin-console in the same PR (round-4 T-4 capability-minor pattern).",
+  "rationale": "Ratified in the Cloudflare round 6 spec (2026-09-06 section 5.4 plus section 5.4.1 admin-console v1.1.0 delta; spec section 1 ruling 7). Ships as v1.0.0 of edge-cloudflare-access and v1.1.0 of application-admin-console in the same PR (round-4 capability-minor pattern).",
   "tags": [
     "blueprint:edge-cloudflare-access",
     "blueprint:application-admin-console"
@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-07T16:00:00.000Z",
-  "updatedAt": "2026-09-07T16:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00.000Z",
+  "deliveredBy": {
+    "adrId": "ADR-3503-edge-cloudflare-access-policy-scope",
+    "field": "decision.capabilityFlip"
+  }
 }

package/blueprints/edge-cloudflare-access/contributions/requirements/edge-cloudflare-access-req-007.json

@@ -0,0 +1,22 @@
+{
+  "reqId": "edge-cloudflare-access-REQ-007",
+  "prdId": "PRD-001",
+  "title": "Policy-shape inputs (email-domain, group-membership, identity-provider, service-token) are dashboard-owned; the shipped guide names every input and every elicit",
+  "description": "The policy-shape enum (email-domain, service-token-only, service-token-plus-email-domain, group-membership) governs which Cloudflare Access policy the operator issues on the dashboard side. The blueprint owns the JWT validator side and does NOT elicit the four dashboard-owned inputs (email domain, group name, identity provider, application/path scope); those inputs live on the Cloudflare Zero Trust dashboard and are named in the shipped guide walk-through. The shipped guide MUST name each of the four dashboard-owned inputs per policy-shape option and MUST name each shipped elicit (access-application-host, access-selfhosted-app-id, access-audience, access-jwks-url, access-policy-shape, access-bypass-service-auth-id) alongside its runtime effect; the applying agent traces every policy the operator issues to the guide entry that names the required input.",
+  "category": "functional",
+  "domain": "edge",
+  "priority": "must",
+  "rationale": "Closes review P1 F-1 (policy-shape options with under-specified inputs). The Cloudflare dashboard is the owner of the identity/group/domain/path inputs (they live in the Access application, not in the JWT validator); the blueprint's job is to document each input in the guide and to elicit only the JWT-side values the validator consumes.",
+  "tags": [
+    "blueprint:edge-cloudflare-access",
+    "capability:zeroTrustGate"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-09T00:00:00.000Z",
+  "updatedAt": "2026-09-09T00:00:00.000Z",
+  "deliveredBy": {
+    "tacId": "TAC-3503-edge-cloudflare-access-policy-shape",
+    "field": "responsibilities.dashboard"
+  }
+}