rcf-lite 0.26.0 → 0.27.0

package/blueprints/edge-cloudflare-access/contributions/user-stories/edge-cloudflare-access-us-34101.json

@@ -11,17 +11,27 @@
   "acceptanceCriteria": [
     {
       "id": "AC-34101-1",
-      "description": "The JWT validator reads Cf-Access-Jwt-Assertion, verifies against the fixture JWKS (RS256, kid rotation supported by the per-kid cache), reduces the principal into request.auth as {email, sub, groups} and the downstream handler receives a 200 with the reduced principal fields exposed on request.auth.",
+      "description": "The JWT validator reads Cf-Access-Jwt-Assertion, verifies against the fixture JWKS (RS256, kid rotation supported by the per-kid cache), reduces the principal into request.auth as {email, sub, groups} and the downstream handler receives a 200 with the reduced principal fields exposed on request.auth. Per section 7a, this AC is legal as the single AC on the story because the guide and the anchored TAC name no additional documented failure path for this mechanism (adjacent failure paths are owned by sibling stories on the same blueprint, not by this one).",
       "given": "a Worker fetch handler wired with createAccessValidator(...).middleware and a fixture-signed JWT presented in the Cf-Access-Jwt-Assertion header",
       "when": "the request dispatches through the validator",
       "then": "the validator resolves, attaches {email, sub, groups} onto request.auth and delegates to the handler which returns 200 with the reduced principal reflected on the response body",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3501-edge-cloudflare-access-jwt-validator",
+        "field": "interfaces.createAccessValidator"
+      },
+      "vendorCitation": {
+        "url": "https://developers.cloudflare.com/cloudflare-one/policies/access/",
+        "verifiedOn": "2026-09-09"
+      }
     }
   ],
   "tacIds": [
     "TAC-3501-edge-cloudflare-access-jwt-validator"
   ],
   "createdAt": "2026-09-07T16:00:00.000Z",
-  "updatedAt": "2026-09-07T16:00:00.000Z"
+  "updatedAt": "2026-09-10T00:00:00.000Z",
+  "description": "Story owns the JWT validator happy path (Cf-Access-Jwt-Assertion accepted, principal reduced onto request.auth). Reject branches (missing header, expired exp, mis-signed, aud-mismatch, jwt-malformed, kid-unknown, jwks-unavailable) live on US-34102 and break-glass branches on US-34107; per section 7a, this story carries a single AC because its own mechanism has no additional documented failure path in the guide or the anchored TAC."
 }

package/blueprints/edge-cloudflare-access/contributions/user-stories/edge-cloudflare-access-us-34102.json

@@ -16,7 +16,68 @@
       "when": "the request dispatches through the validator",
       "then": "the validator returns 401 and emits one audit event whose outcome is drawn from {missing, expired, invalid} with the allowed-key shape",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3501-edge-cloudflare-access-jwt-validator",
+        "field": "interfaces.createAccessValidator"
+      }
+    },
+    {
+      "id": "AC-34102-2",
+      "description": "Given a well-formed JWT whose aud claim does not match the elicited access-audience, when the validator checks the token, the request is refused with HTTP 401, no downstream handler runs, and exactly one metadata-only audit event with outcome:\"reject\" reason:\"aud-mismatch\" fires; the audit record carries no token substring.",
+      "given": "the fixture applied source with the validator wired and the elicited access-audience configured",
+      "when": "a request presents a well-formed JWT whose aud claim does not match the elicited access-audience",
+      "then": "the validator returns 401 with reason \"aud-mismatch\" and emits one metadata-only audit event",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3501-edge-cloudflare-access-jwt-validator",
+        "field": "interfaces.createAccessValidator"
+      }
+    },
+    {
+      "id": "AC-34102-3",
+      "description": "Given a malformed JWT (three-segment shape violated, base64url decode fails, or JSON parse fails on any segment), when the validator inspects the token, the request is refused with HTTP 401 outcome:\"reject\" reason:\"jwt-malformed\" and one metadata-only audit event fires; no downstream handler runs.",
+      "given": "the fixture applied source with the validator wired",
+      "when": "a request presents a malformed Cf-Access-Jwt-Assertion (not three dot-separated segments, or base64url/JSON parse fails)",
+      "then": "the validator returns 401 reason \"jwt-malformed\" and emits one metadata-only audit event; no downstream handler runs",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3501-edge-cloudflare-access-jwt-validator",
+        "field": "interfaces.createAccessValidator"
+      }
+    },
+    {
+      "id": "AC-34102-4",
+      "description": "Given a JWT whose kid header does not resolve to any key in the current JWKS after a single forced refresh, when the validator attempts signature verification, the request is refused with HTTP 401 outcome:\"reject\" reason:\"kid-unknown\" and one metadata-only audit event fires; no downstream handler runs and no more than one JWKS refresh fires per request.",
+      "given": "the fixture applied source with the validator wired and a JWKS whose current keys do not include the token kid",
+      "when": "a request presents a JWT whose kid header is absent from JWKS both before and after a forced refresh",
+      "then": "the validator returns 401 reason \"kid-unknown\", emits one metadata-only audit event, and no more than one JWKS refresh fires per request",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3501-edge-cloudflare-access-jwt-validator",
+        "field": "interfaces.createAccessValidator"
+      }
+    },
+    {
+      "id": "AC-34102-5",
+      "description": "Given the JWKS endpoint returns a non-2xx or a network error on both the initial fetch and the forced refresh, when the validator attempts verification, the request is refused with HTTP 503 outcome:\"reject\" reason:\"jwks-unavailable\" fail-closed and one metadata-only audit event fires; no downstream handler runs; the response carries no upstream body echo.",
+      "given": "the fixture applied source with the validator wired and an injected fetch that fails the JWKS endpoint on both attempts",
+      "when": "a request presents a well-formed JWT and the validator attempts to load the JWKS",
+      "then": "the validator returns 503 reason \"jwks-unavailable\" (fail-closed) and emits one metadata-only audit event",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3501-edge-cloudflare-access-jwt-validator",
+        "field": "interfaces.createAccessValidator"
+      }
     }
   ],
   "tacIds": [
@@ -24,5 +85,5 @@
     "TAC-3504-edge-cloudflare-access-audit-sink"
   ],
   "createdAt": "2026-09-07T16:00:00.000Z",
-  "updatedAt": "2026-09-07T16:00:00.000Z"
+  "updatedAt": "2026-09-09T12:00:00.000Z"
 }

package/blueprints/edge-cloudflare-access/contributions/user-stories/edge-cloudflare-access-us-34103.json

@@ -11,17 +11,32 @@
   "acceptanceCriteria": [
     {
       "id": "AC-34103-1",
-      "description": "The sole-reader scan walks the fixture applied source root (src/**/*.mjs), strips comments and string literals, and finds exactly one live-source occurrence of the header string Cf-Access-Jwt-Assertion, in src/jwt-validator.mjs. Any other live-source occurrence in a shipped module fails the probe (SIMULATE_NON_VALIDATOR_HEADER=true injects a second hit and the probe fails).",
+      "description": "Given the canonical fixture applied source root (src/**/*.mjs), when the sole-reader scan walks the tree, strips comments and string literals, and searches for live-source occurrences of the header string Cf-Access-Jwt-Assertion, the scan finds exactly one live-source occurrence in src/jwt-validator.mjs and the probe returns aggregateVerdict:pass.",
       "given": "the cf-edge fixture applied source tree",
       "when": "the sole-reader-scan probe walks src/**/*.mjs",
       "then": "the only live-source hit for Cf-Access-Jwt-Assertion is in src/jwt-validator.mjs",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-34103-2",
+      "description": "Given the SIMULATE_NON_VALIDATOR_HEADER=true switch (a second live-source occurrence of Cf-Access-Jwt-Assertion is injected outside src/jwt-validator.mjs), when the sole-reader scan runs on the fixture applied source root, the probe returns aggregateVerdict:fail with detail naming the offending file path.",
+      "given": "the fixture applied source root with SIMULATE_NON_VALIDATOR_HEADER=true (a second live-source hit on Cf-Access-Jwt-Assertion injected outside src/jwt-validator.mjs)",
+      "when": "the sole-reader scan runs",
+      "then": "the probe returns aggregateVerdict:fail with detail naming the offending file path",
+      "testable": true,
+      "scope": "library",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3501-edge-cloudflare-access-jwt-validator",
+        "field": "responsibilities.headerSoleReader"
+      }
     }
   ],
   "tacIds": [
     "TAC-3501-edge-cloudflare-access-jwt-validator"
   ],
   "createdAt": "2026-09-07T16:00:00.000Z",
-  "updatedAt": "2026-09-07T16:00:00.000Z"
+  "updatedAt": "2026-09-09T13:00:00.000Z"
 }

package/blueprints/edge-cloudflare-access/contributions/user-stories/edge-cloudflare-access-us-34104.json

@@ -11,17 +11,50 @@
   "acceptanceCriteria": [
     {
       "id": "AC-34104-1",
-      "description": "blueprint.json elicits access-application-host (kind string) and access-selfhosted-app-id (kind string; the operator supplies exactly one), plus access-audience (kind string), access-jwks-url (kind string), access-policy-shape (kind enum with options email-domain, service-token-only, service-token-plus-email-domain, group-membership; recommended default email-domain) and access-bypass-service-auth-id (kind string; blank disables break-glass). Applying the blueprint records the elicited values on rcf/blueprints/edge-cloudflare-access.applied.json.",
+      "description": "blueprint.json elicits access-application-host (kind string) and access-selfhosted-app-id (kind string; the operator supplies exactly one), plus access-audience (kind string), access-jwks-url (kind string), access-policy-shape (kind enum with options email-domain, service-token-only, service-token-plus-email-domain, group-membership; recommended default email-domain) and access-bypass-service-auth-id (kind string; blank disables break-glass). Applying the blueprint records the elicited values on rcf/blueprints/edge-cloudflare-access.applied.json. Applying agent sets: the applying agent picks exactly one of access-application-host or access-selfhosted-app-id, sets access-audience, access-jwks-url, one of the four access-policy-shape enum values, and (optionally) an access-bypass-service-auth-id.",
       "given": "the blueprint.json elicits block",
       "when": "the apply verb runs against a fixture project",
       "then": "rcf/blueprints/edge-cloudflare-access.applied.json carries the elicited values plus appliedCapabilities=[zeroTrustGate]",
       "testable": true,
-      "scope": "library"
+      "scope": "library",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-3502-edge-cloudflare-access-application-declaration",
+        "field": "interfaces.applicationDeclaration"
+      }
+    },
+    {
+      "id": "AC-34104-2",
+      "description": "Given neither access-application-host nor access-selfhosted-app-id is supplied at apply time, when the applying agent runs apply, the apply verb refuses with a stable validation code apply.application-declaration-missing naming both elicit ids and writes no sidecar.",
+      "given": "blueprint.json elicits access-application-host and access-selfhosted-app-id, both empty at apply time",
+      "when": "the applying agent runs apply",
+      "then": "apply refuses with code apply.application-declaration-missing and rcf/blueprints/edge-cloudflare-access.applied.json is not written",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3502-edge-cloudflare-access-application-declaration",
+        "field": "responsibilities.applicationDeclaration"
+      }
+    },
+    {
+      "id": "AC-34104-3",
+      "description": "Given both access-application-host AND access-selfhosted-app-id are supplied at apply time, when the applying agent runs apply, the apply verb refuses with a stable validation code apply.application-declaration-ambiguous naming both elicit ids and writes no sidecar.",
+      "given": "blueprint.json elicits access-application-host and access-selfhosted-app-id, both non-empty at apply time",
+      "when": "the applying agent runs apply",
+      "then": "apply refuses with code apply.application-declaration-ambiguous and rcf/blueprints/edge-cloudflare-access.applied.json is not written",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3502-edge-cloudflare-access-application-declaration",
+        "field": "responsibilities.applicationDeclaration"
+      }
     }
   ],
   "tacIds": [
     "TAC-3502-edge-cloudflare-access-application-declaration"
   ],
   "createdAt": "2026-09-07T16:00:00.000Z",
-  "updatedAt": "2026-09-07T16:00:00.000Z"
+  "updatedAt": "2026-09-09T13:00:00.000Z"
 }

package/blueprints/edge-cloudflare-access/contributions/user-stories/edge-cloudflare-access-us-34105.json

@@ -11,17 +11,27 @@
   "acceptanceCriteria": [
     {
       "id": "AC-34105-1",
-      "description": "The shipped guide/edge-cloudflare-access.md carries a section Zero Trust dashboard walk-through with numbered steps naming each screen; and a section API alternative with a curl example against https://api.cloudflare.com/client/v4/accounts/{account_id}/access/apps/{app_id}/policies; the vendor URL https://developers.cloudflare.com/cloudflare-one/policies/access/ is cited from ADR-3501 and the guide.",
+      "description": "The shipped guide/edge-cloudflare-access.md carries a section Zero Trust dashboard walk-through with numbered steps naming each screen; and a section API alternative with a curl example against https://api.cloudflare.com/client/v4/accounts/{account_id}/access/apps/{app_id}/policies; the vendor URL https://developers.cloudflare.com/cloudflare-one/policies/access/ is cited from ADR-3501 and the guide. Per section 7a, this AC is legal as the single AC on the story because the guide and the anchored TAC name no additional documented failure path for this mechanism (adjacent failure paths are owned by sibling stories on the same blueprint, not by this one).",
       "given": "the shipped guide file",
       "when": "the anatomy test greps for the two section headings, the curl example and the vendor URL",
       "then": "each string matches at least once in the file",
       "testable": true,
-      "scope": "library"
+      "scope": "library",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3502-edge-cloudflare-access-application-declaration",
+        "field": "interfaces.applicationDeclaration"
+      },
+      "vendorCitation": {
+        "url": "https://developers.cloudflare.com/cloudflare-one/policies/access/",
+        "verifiedOn": "2026-09-09"
+      }
     }
   ],
   "tacIds": [
     "TAC-3503-edge-cloudflare-access-policy-shape"
   ],
   "createdAt": "2026-09-07T16:00:00.000Z",
-  "updatedAt": "2026-09-07T16:00:00.000Z"
+  "updatedAt": "2026-09-10T00:00:00.000Z",
+  "description": "Story owns the guide-section presence assertion for the Zero Trust dashboard walk-through and the API alternative. Per section 7a, this story carries a single AC because the guide names no runtime failure path for the guide-section-presence mechanism."
 }

package/blueprints/edge-cloudflare-access/contributions/user-stories/edge-cloudflare-access-us-34106.json

@@ -11,17 +11,23 @@
   "acceptanceCriteria": [
     {
       "id": "AC-34106-1",
-      "description": "After 5 validate-pass and 5 validate-reject requests the audit sink holds 10 records each carrying exactly {email, outcome, timestamp, path}; the serialised JSON of every record contains no substring of the JWT (header, payload or signature), no Authorization value and no header names beyond path.",
+      "description": "After 5 validate-pass and 5 validate-reject requests the audit sink holds 10 records each carrying exactly {email, outcome, timestamp, path}; the serialised JSON of every record contains no substring of the JWT (header, payload or signature), no Authorization value and no header names beyond path. Per section 7a, this AC is legal as the single AC on the story because the guide and the anchored TAC name no additional documented failure path for this mechanism (adjacent failure paths are owned by sibling stories on the same blueprint, not by this one).",
       "given": "the shipped createAccessValidator wired with a spy audit sink and 10 requests (5 pass, 5 reject)",
       "when": "the requests dispatch through the validator",
       "then": "10 sink records, each with allowed keys only, none containing forbidden substrings",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3501-edge-cloudflare-access-jwt-validator",
+        "field": "interfaces.createAccessValidator"
+      }
     }
   ],
   "tacIds": [
     "TAC-3504-edge-cloudflare-access-audit-sink"
   ],
   "createdAt": "2026-09-07T16:00:00.000Z",
-  "updatedAt": "2026-09-07T16:00:00.000Z"
+  "updatedAt": "2026-09-10T00:00:00.000Z",
+  "description": "Story owns the audit-event record-shape assertion (10 records across 5 pass and 5 reject requests, exact key set, no token substring). Reject-branch outcomes are covered by US-34102; per section 7a, this story carries a single AC because the record-shape mechanism has no additional documented failure path in the guide or the anchored TAC."
 }

package/blueprints/edge-cloudflare-access/contributions/user-stories/edge-cloudflare-access-us-34107.json

@@ -11,17 +11,82 @@
   "acceptanceCriteria": [
     {
       "id": "AC-34107-1",
-      "description": "When the request presents the elicited service-auth id and secret (as CF-Access-Client-Id and CF-Access-Client-Secret headers), the validator observes the pair, records outcome=bypass in the audit event with the metadata-only shape, and delegates to the handler as authenticated with request.auth.email='service:'+id. Break-glass is disabled unless the elicited pair is applied.",
+      "description": "When the request presents the elicited service-auth id and secret (as CF-Access-Client-Id and CF-Access-Client-Secret headers), the validator observes the pair, records outcome=bypass in the audit event with the metadata-only shape, and delegates to the handler as authenticated with request.auth.email='service:'+id. Break-glass is disabled unless the elicited pair is applied. Applying agent sets: the applying agent sets the elicited access-bypass-service-auth-id and its paired secret; the bypass observable (delegates as authenticated with request.auth.email='service:'+id) is a pure function of that pair.",
       "given": "the createAccessValidator wired with an elicited bypass-service-auth pair and a request presenting the paired headers",
       "when": "the request dispatches through the validator",
       "then": "the handler receives request.auth with the service principal and the audit sink records outcome=bypass with allowed keys only",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-3501-edge-cloudflare-access-jwt-validator",
+        "field": "interfaces.createAccessValidator"
+      },
+      "vendorCitation": {
+        "url": "https://developers.cloudflare.com/cloudflare-one/identity/service-tokens/",
+        "verifiedOn": "2026-09-09"
+      }
+    },
+    {
+      "id": "AC-34107-2",
+      "description": "Given no bypass-service-auth id is elicited (empty string, break-glass disabled), when a request presents CF-Access-Client-Id and CF-Access-Client-Secret headers, the validator ignores the bypass path entirely and falls through to normal JWT validation; the audit event carries outcome:\"reject\" reason:\"jwt-missing\" when no JWT accompanies the headers, never outcome:\"bypass\".",
+      "given": "the fixture applied source with break-glass disabled (access-bypass-service-auth-id empty)",
+      "when": "a request presents CF-Access-Client-Id and CF-Access-Client-Secret headers but no Cf-Access-Jwt-Assertion",
+      "then": "the validator refuses 401 with outcome \"reject\" reason \"jwt-missing\"; no bypass principal is set and no outcome \"bypass\" audit event fires",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3501-edge-cloudflare-access-jwt-validator",
+        "field": "interfaces.createAccessValidator"
+      }
+    },
+    {
+      "id": "AC-34107-3",
+      "description": "Given the elicited break-glass service-auth pair is present, when a request presents CF-Access-Client-Id that does not match the elicited id and any CF-Access-Client-Secret, the validator refuses 401 with outcome:\"reject\" reason:\"bypass-id-mismatch\"; no bypass principal is set on request.auth and no outcome:\"bypass\" audit event fires. Applying agent sets: the applying agent sets the elicited access-bypass-service-auth-id; a request whose CF-Access-Client-Id differs from the applied value is refused with bypass-id-mismatch.",
+      "given": "the fixture applied source with break-glass enabled and the elicited id and secret configured",
+      "when": "a request presents a wrong CF-Access-Client-Id with any secret",
+      "then": "the validator refuses 401 with outcome \"reject\" reason \"bypass-id-mismatch\" and no bypass principal is set",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-3501-edge-cloudflare-access-jwt-validator",
+        "field": "interfaces.createAccessValidator"
+      }
+    },
+    {
+      "id": "AC-34107-4",
+      "description": "Given the elicited break-glass service-auth pair is present, when a request presents the correct CF-Access-Client-Id with a wrong CF-Access-Client-Secret, the validator refuses 401 with outcome:\"reject\" reason:\"bypass-secret-mismatch\" using a constant-time compare; no bypass principal is set and no outcome:\"bypass\" audit event fires. Applying agent sets: the applying agent sets the elicited paired secret; a request whose CF-Access-Client-Secret differs from the applied value is refused with bypass-secret-mismatch under a constant-time compare.",
+      "given": "the fixture applied source with break-glass enabled and the elicited pair configured",
+      "when": "a request presents the correct client id but a wrong secret",
+      "then": "the validator refuses 401 with outcome \"reject\" reason \"bypass-secret-mismatch\" and no bypass principal is set",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-3501-edge-cloudflare-access-jwt-validator",
+        "field": "interfaces.createAccessValidator"
+      }
+    },
+    {
+      "id": "AC-34107-5",
+      "description": "Given the elicited break-glass service-auth pair is present, when a request presents only one of CF-Access-Client-Id or CF-Access-Client-Secret (never both), the validator falls through to normal JWT validation and refuses 401 with outcome:\"reject\" reason:\"jwt-missing\" (or whichever JWT-path reason applies); no partial-bypass principal is set and no outcome:\"bypass\" audit event fires. Applying agent sets: the applying agent sets both halves of the elicited bypass pair; a request presenting only one half falls through to JWT validation and is refused with the appropriate JWT-path reason.",
+      "given": "the fixture applied source with break-glass enabled and the elicited pair configured",
+      "when": "a request presents exactly one of CF-Access-Client-Id or CF-Access-Client-Secret",
+      "then": "the validator falls through to JWT validation; no bypass principal is set and no bypass audit event fires",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-3501-edge-cloudflare-access-jwt-validator",
+        "field": "interfaces.createAccessValidator"
+      }
     }
   ],
   "tacIds": [
     "TAC-3501-edge-cloudflare-access-jwt-validator"
   ],
   "createdAt": "2026-09-07T16:00:00.000Z",
-  "updatedAt": "2026-09-07T16:00:00.000Z"
+  "updatedAt": "2026-09-09T13:00:00.000Z"
 }

package/blueprints/edge-cloudflare-access/contributions/user-stories/edge-cloudflare-access-us-34108.json

@@ -11,17 +11,19 @@
   "acceptanceCriteria": [
     {
       "id": "AC-34108-1",
-      "description": "Two applied combinations are exercised on the extended admin-console fixture: with ?caps=principalDirectory,roleModel,auditLog,zeroTrustGate the sign-in surface renders [data-surface=access-gated] and no [data-surface=local-login] is present; with ?caps=principalDirectory,roleModel,auditLog the sign-in surface renders [data-surface=local-login] and no [data-surface=access-gated] is present. Both combinations exercise the shipped pack check AC-21815-1 on application-admin-console.pack.mjs (pack check fires only on the gated combination).",
+      "description": "Two applied combinations are exercised on the extended admin-console fixture: with ?caps=principalDirectory,roleModel,auditLog,zeroTrustGate the sign-in surface renders [data-surface=access-gated] and no [data-surface=local-login] is present; with ?caps=principalDirectory,roleModel,auditLog the sign-in surface renders [data-surface=local-login] and no [data-surface=access-gated] is present. Both combinations exercise the shipped pack check AC-21815-1 on application-admin-console.pack.mjs (pack check fires only on the gated combination). Per section 7a, this AC is legal as the single AC on the story because the guide and the anchored TAC name no additional documented failure path for this mechanism (adjacent failure paths are owned by sibling stories on the same blueprint, not by this one).",
       "given": "the extended admin-console pack fixture with the two caps combinations",
       "when": "the pack runs against each combination",
       "then": "AC-21815-1 fires on the gated combination and passes; the existing v1.0.0 surface renders on the non-gated combination and its own checks pass",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [
     "TAC-3502-edge-cloudflare-access-application-declaration"
   ],
   "createdAt": "2026-09-07T16:00:00.000Z",
-  "updatedAt": "2026-09-07T16:00:00.000Z"
+  "updatedAt": "2026-09-10T00:00:00.000Z",
+  "description": "Story owns the admin-console sign-in surface flip between the access-gated data-surface and the local-login data-surface. Both applied capability-set combinations are exercised in-AC. Per section 7a, this story carries a single AC because the capability-set flip mechanism has no additional documented failure path in the guide or the anchored TAC."
 }

package/blueprints/edge-cloudflare-access/contributions/user-stories/edge-cloudflare-access-us-34109.json

@@ -5,23 +5,29 @@
   "version": "1.0.0",
   "status": "approved",
   "title": "Real-account gated URL round-trip against a scheduled Access-configured hostname",
-  "asA": "HQ operator running the real-account gated-URL smoke against a scheduled Access-configured hostname",
+  "asA": "operator running the real-account gated-URL smoke against a scheduled Access-configured hostname",
   "iWant": "the probe to fire against the hostname when the env vars are present and record accountBoundSkipped when not",
   "soThat": "the mechanism-reach claim is proven on a real Cloudflare Access instance without ever failing the shelf gate on the absence of an account",
   "acceptanceCriteria": [
     {
       "id": "AC-34109-1",
-      "description": "With CI_HAS_CLOUDFLARE_ACCOUNT=true and CF_ACCESS_HOST=<hostname>, a plain fetch against https://<hostname>/ follows the redirect chain and terminates at an https://<team>.cloudflareaccess.com/ URL (the Access UI). Without either env var the probe records accountBoundSkipped=true and aggregateVerdict=pass per spec section 3.5.",
+      "description": "With CI_HAS_CLOUDFLARE_ACCOUNT=true and CF_ACCESS_HOST=<hostname>, a plain fetch against https://<hostname>/ follows the redirect chain and terminates at an https://<team>.cloudflareaccess.com/ URL (the Access UI). Without either env var the probe records accountBoundSkipped=true and aggregateVerdict=pass per spec section 3.5. Applying agent sets: the applying agent sets CF_ACCESS_HOST (the hostname the account-bound probe fetches) and toggles CI_HAS_CLOUDFLARE_ACCOUNT in the operator environment for the account-bound run. Per section 7a, this AC is legal as the single AC on the story because the guide and the anchored TAC name no additional documented failure path for this mechanism (adjacent failure paths are owned by sibling stories on the same blueprint, not by this one).",
       "given": "the run-real-account-gated-url.mjs probe shim and the two env vars",
       "when": "the probe runs",
       "then": "in the CI-with-account path the redirect chain reports cloudflareaccess.com as terminal; in the without-env path accountBoundSkipped is true",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template",
+      "vendorCitation": {
+        "url": "https://developers.cloudflare.com/cloudflare-one/policies/access/",
+        "verifiedOn": "2026-09-09"
+      }
     }
   ],
   "tacIds": [
     "TAC-3502-edge-cloudflare-access-application-declaration"
   ],
   "createdAt": "2026-09-07T16:00:00.000Z",
-  "updatedAt": "2026-09-07T16:00:00.000Z"
+  "updatedAt": "2026-09-10T00:00:00.000Z",
+  "description": "Story owns the account-bound Access redirect probe with the accountBoundSkipped fall-through. Per section 7a, this story carries a single AC because the redirect-shape mechanism has no additional documented failure path in the guide or the anchored TAC."
 }

package/blueprints/edge-cloudflare-access/contributions/user-stories/edge-cloudflare-access-us-34110.json

@@ -0,0 +1,33 @@
+{
+  "usId": "edge-cloudflare-access-US-34110",
+  "prdId": "PRD-001",
+  "reqId": "edge-cloudflare-access-REQ-007",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Guide walk-through names every dashboard-owned policy input per policy-shape and every shipped elicit",
+  "asA": "operator issuing an Access policy from the dashboard side",
+  "iWant": "the guide to name every input the dashboard needs per policy shape (email domain for email-domain; group name and identity provider for group-membership; service-token id and secret elicits for service-token-only and service-token-plus-email-domain; application/path scope for every shape) and every shipped elicit",
+  "soThat": "a policy issued from the guide walk-through is complete without back-and-forth between the guide and the vendor docs",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-34110-1",
+      "description": "The shipped guide (guide/<slug>.md within this blueprint) contains a section Policy shape enum that names, per policy-shape option, the required dashboard-owned inputs: email-domain names the required email-domain input; group-membership names the required group-name input and the required identity-provider selection; service-token-only names the required service-token id and paired secret (linked to the bypass-service-auth-id elicit); service-token-plus-email-domain names both the email-domain and the service-token pair; every shape names the required application-vs-path scope input. The guide additionally names every shipped elicit (application-host, selfhosted-app-id, audience, jwks-url, policy-shape, bypass-service-auth-id) with its runtime effect. Per section 7a, this AC is legal as the single AC on the story because the guide and the anchored TAC name no additional documented failure path for this mechanism (adjacent failure paths are owned by sibling stories on the same blueprint, not by this one).",
+      "given": "the shipped guide file",
+      "when": "a source-tree grep asserts the required substrings per shape and elicit",
+      "then": "every required substring is present; a fixture that omits any of them refuses the probe with a stable code guide.policy-inputs-missing naming which substring is absent",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3503-edge-cloudflare-access-policy-shape",
+        "field": "responsibilities.policyIssueGuide"
+      }
+    }
+  ],
+  "tacIds": [
+    "TAC-3503-edge-cloudflare-access-policy-shape"
+  ],
+  "createdAt": "2026-09-09T00:00:00.000Z",
+  "updatedAt": "2026-09-10T00:00:00.000Z",
+  "description": "Story owns the guide-section presence assertion for the policy-shape enum. Per section 7a, this story carries a single AC because the guide names no runtime failure path for the guide-section-presence mechanism."
+}

package/blueprints/edge-cloudflare-access/docs/topics.md

@@ -64,7 +64,7 @@ US 34101-34109 sit at the LOW end of the 34101-34899 band on purpose (watchpost
 ## Shared expectations for future composing blueprints
 
 - Reuse `edgeAuthenticationGate` exactly as spelled here when your blueprint holds an opinion on the edge authentication gate contract; contribute your own scope:global ADR on that string and let composition surface the pairing.
-- Consumer blueprints reading the `zeroTrustGate` capability declared on `blueprint.json` per section 6a of `blueprint-authoring.md` obtain the Access-gated composition at apply time via the T-5 visual-round capability-declaration mechanism.
+- Consumer blueprints reading the `zeroTrustGate` capability declared on `blueprint.json` per section 6a of `blueprint-authoring.md` obtain the Access-gated composition at apply time via the visual-round capability-declaration mechanism.
 
 ## Deliberate-conflict statement
 

package/blueprints/edge-cloudflare-rate-limiting/CHANGELOG.md

@@ -1,6 +1,40 @@
 # edge-cloudflare-rate-limiting changelog
 
-## 1.0.0 (round 6 T-6, 2026-09-07)
+## 1.1.3 - 2026-09-10
+
+Positive-evidence rule alignment on the probe pack skip path (authoring standard section 7d); vendor citation on the guide-section AC; register tidy in shipped prose (no capability change).
+
+- Probes and fixture: the account-bound skip return on `contributions/probes/real-account-burst-and-429.mjs` now carries a `reason` field naming the exact env var(s) that were unset; added a "Declared env vars" section to the shared fixture README (`packages/rcf-lite/test/fixtures/cf-edge/README.md`), per authoring standard section 7d. Skip-path probe reports regenerated so the shipped shape carries the new field.
+- Closes F-6: AC-36102-1 on US-36102 now carries a vendorCitation pointing at the Cloudflare WAF rate-limiting rules documentation, verified on 2026-09-10.
+- Closes F-7: README trailing clause with the internal spec reference removed.
+- Closes F-8: guide leading provenance sentence removed.
+
+## 1.1.2 - 2026-09-10
+
+Capability token named in the requirements layer; single-mechanism story legality notes; owner reference for the drift-audit and request-event record shapes.
+
+- Extended REQ-001 description to name the declared `edgeRateLimit` capability token verbatim with a one-line runtime clause tying the token to the rules-manifest mechanism that delivers it.
+- Added AC-36101-2 on US-36101 as a fixed AC that binds the manifest-declared `edgeRateLimit` token to the presence of at least one schema-valid rule under the applied manifest directory.
+- Appended the section 7a legality note to AC-36101-1, AC-36102-1 and AC-36105-1 recording that each single-AC story's mechanism has no additional documented failure path in the guide or the anchored TAC (adjacent failure paths are owned by sibling stories, not by these).
+- Rewrote REQ-004 description to reference the owning TAC (`TAC-3703-edge-cloudflare-rate-limiting-drift-audit-runner.purpose`) for the drift-audit record shape and the runtime request-event record shape, rather than restating the shapes verbatim.
+
+## 1.1.1 (register-sweep patch, 2026-09-10)
+
+- Register: neutral wording in shipped prose (no capability change).
+
+## 1.1.0 - 2026-09-09
+
+hardening pass edge (criterion a REQ-layer backing; criterion b AC-set sufficiency; criterion c chain consistency lint-zero on pass 1 and pass 2).
+
+- Added failure-path ACs to US-36103 (origin-not-executed AC-36103-2 closes F-1: 429 refuses before origin), US-36104 (AC-36104-2 fake-clock cadence assertion closes F-2; AC-36104-3..7 close F-5 drift-runner failure paths for missing zone id, API auth, throttled, malformed and timeout).
+- Split the drift-audit record shape from the runtime request-event record shape: drift records carry `{ruleId, outcome, timestamp, diff}` (no `clientIpHash`, no client on the API path); request-event records carry `{ruleId, clientIpHash, outcome, timestamp}` with a hashed prefix. REQ-004, TAC-3703 responsibilities, AC-36104-1 and AC-36107-1 all now use these exact shapes (closes specimen F-3).
+- Clarified TAC-3701 and REQ-001 that the manifest schema has seven required fields plus one optional `description` field (aligns TAC with the shipped schema; closes specimen F-4).
+- Every REQ now carries `deliveredBy`; every AC carries `disposition`; ACs referencing owner-owned literals carry `ownerRef`.
+- Chain-consistency lint reports 0 findings on both passes.
+- Review fix pass (2026-09-09): finished the split of the drift-audit record shape from the request-event shape by rewriting the TAC-3703 purpose second sentence and the guide's `## Drift audit` section to state the drift record as `{ruleId, outcome, timestamp, diff}` and the request-event record as `{ruleId, clientIpHash, outcome, timestamp}` (closes F-2); the README event-secrecy row assertion now names both shapes. Split every bundled single-AC story on a per-failure-path basis: US-36106 (canonical-pass + SIMULATE_SCHEMA_INVALID-fail), US-36107 (canonical-shape + SIMULATE_EVENT_LEAK_IP-fail), US-36108 (canonical-pass + SIMULATE_MANIFEST_MISSING-fail); each new AC carries a concrete oracle (probe verdict + named field) and an `ownerRef`. Re-judged disposition per AC: mechanism-invariant refusal reasons, record-shape keys and probe verdicts stay `fixed`; US-36101 AC-36101-1 and US-36103 AC-36103-1/-2 re-marked `template` naming the values the applying agent sets (the rate-limit-rules-dir path, per-rule id/expression/threshold/period/characteristics/action/duration, the elicited rate-limit-zone-id, and CF_RATE_LIMIT_URL for the account-bound probe). Genuinely single-mechanism stories (US-36101, US-36102, US-36105) carry the section-7a note inside the story `description` field, not in a schema-illegal new field.
+
+
+## 1.0.0 (round 6, 2026-09-07)
 
 - First shipped version. Zone-level rate limiting as an edge gate in front of Worker handlers per the ratified `cloudflare-round-6-spec-2026-09-06.md` section 5.6.
 - Five REQs, eight USs, three TACs, four ADRs. Twenty contributions total.

package/blueprints/edge-cloudflare-rate-limiting/README.md

@@ -1,6 +1,6 @@
 # edge-cloudflare-rate-limiting
 
-Zone-level rate limiting as an edge gate in front of Worker handlers, configured through a local manifest the applying project commits and applies to the live Cloudflare zone via a documented wrangler or dashboard flow. Ships v1.0.0 of the round-6 T-6 track per `projects/blueprint-library/specs/cloudflare-round-6-spec-2026-09-06.md` section 5.6.
+Zone-level rate limiting as an edge gate in front of Worker handlers, configured through a local manifest the applying project commits and applies to the live Cloudflare zone via a documented wrangler or dashboard flow.
 
 - **Category:** `edge`.
 - **Capability provided:** `edgeRateLimit`.
@@ -48,7 +48,7 @@ Four Node-only probes under `contributions/probes/`; three run in CI, one is acc
 | --- | --- | --- | --- |
 | `manifest-presence.mjs` | AC-36101-1 (also AC-36108-1 under `SIMULATE_MANIFEST_MISSING=true`) | false | Reads `cf-edge/cloudflare/rate-limits/`, asserts every file parses, carries the seven required fields and holds no plaintext secret. |
 | `manifest-schema-validate.mjs` | AC-36106-1 | false | Validates every manifest file against the shipped JSON Schema. Under `SIMULATE_SCHEMA_INVALID=true` writes a scratch file missing `threshold` and fails. |
-| `event-secrecy.mjs` | AC-36107-1 | false | Drives the shipped drift-audit runner realisation with a synthetic manifest and a fake fetch; asserts every drift record carries only `{ruleId, clientIpHash, outcome, timestamp, diff}`. Under `SIMULATE_EVENT_LEAK_IP=true` the runner injects a full IP and the probe fails. |
+| `event-secrecy.mjs` | AC-36107-1 | false | Drives the shipped drift-audit runner realisation with a synthetic manifest and a fake fetch; asserts every drift-audit and request-event record matches the metadata-only shapes declared on `TAC-3703-edge-cloudflare-rate-limiting-drift-audit-runner.purpose`. Under `SIMULATE_EVENT_LEAK_IP=true` the runner injects a full IP and the probe fails. |
 | `real-account-burst-and-429.mjs` | AC-36103-1 | true | Fires an in-process burst against `CF_RATE_LIMIT_URL` under `CI_HAS_CLOUDFLARE_ACCOUNT=true` and asserts the (N+1)th and subsequent responses return 429 with `Retry-After` and `Cf-Ray`. Without either env var records `accountBoundSkipped: true` and aggregates to `pass` per spec section 3.5 and ruling 6. |
 
 ### Ruling 6 restated
@@ -66,7 +66,7 @@ When both blueprints apply, the zone-level rate rule (characteristic set: IP-per
 
 ## Vendor citations
 
-- Cloudflare WAF rate-limiting rules: `https://developers.cloudflare.com/waf/rate-limiting-rules/` (documents `expression`, `threshold`, `period`, `characteristics`, `action`, `duration`; fetched 200 on 2026-09-07 for the round-6 T-6 ship).
+- Cloudflare WAF rate-limiting rules: `https://developers.cloudflare.com/waf/rate-limiting-rules/` (documents `expression`, `threshold`, `period`, `characteristics`, `action`, `duration`; fetched 200 on 2026-09-07).
 
 ## Known mechanism-reach gaps
 

package/blueprints/edge-cloudflare-rate-limiting/blueprint.json

@@ -1,6 +1,6 @@
 {
   "slug": "edge-cloudflare-rate-limiting",
-  "version": "1.0.0",
+  "version": "1.1.3",
   "category": "edge",
   "capabilities": [
     "edgeRateLimit"

package/blueprints/edge-cloudflare-rate-limiting/contributions/probes/real-account-burst-and-429.mjs

@@ -36,14 +36,22 @@ export default async function runProbe() {
   const has = process.env.CI_HAS_CLOUDFLARE_ACCOUNT === 'true';
   const url = process.env.CF_RATE_LIMIT_URL || '';
   if (!has || !url) {
+    // Positive-evidence rule (authoring standard section 7d): the skip
+    // record names the exact env var(s) that were unset in `reason`,
+    // so a `pass` verdict is legal without positive evidence.
+    const unset = [];
+    if (!has) unset.push('CI_HAS_CLOUDFLARE_ACCOUNT');
+    if (!url) unset.push('CF_RATE_LIMIT_URL');
+    const reason = unset.join(', ');
     return {
       results: [{
         anchorAcId: 'AC-36103-1',
         verdict: 'pass',
         accountBoundSkipped: true,
-        detail: `accountBoundSkipped: CI_HAS_CLOUDFLARE_ACCOUNT=${has} CF_RATE_LIMIT_URL=${url ? 'set' : 'unset'}; per spec section 3.5 and ruling 6 pass-with-skip.`,
+        reason,
+        detail: `accountBoundSkipped: ${reason} unset; per spec section 3.5 and ruling 6 pass-with-skip.`,
       }],
-      extra: { accountBoundSkipped: true },
+      extra: { accountBoundSkipped: true, reason },
     };
   }
   const threshold = Number.parseInt(process.env.CF_RATE_LIMIT_THRESHOLD || '60', 10);

package/blueprints/edge-cloudflare-rate-limiting/contributions/requirements/edge-cloudflare-rate-limiting-req-001.json

@@ -2,7 +2,7 @@
   "reqId": "edge-cloudflare-rate-limiting-REQ-001",
   "prdId": "PRD-001",
   "title": "The rate-limit rule set is committed to the applying project as a local manifest under cloudflare/rate-limits/, one JSON file per rule",
-  "description": "The applying project holds its rate-limit rule set as a set of JSON documents under the elicited rate-limit-rules-dir (default cloudflare/rate-limits/), one file per rule per ADR-3703. Every manifest file declares the seven documented fields the Cloudflare WAF rate-limiting rules contract names per https://developers.cloudflare.com/waf/rate-limiting-rules/: id (a stable operator-facing string), expression (the WAF rules-language expression string), threshold (positive integer), period (seconds), characteristics (non-empty array of stable characteristic strings), action (block or challenge or log or managed_challenge), duration (seconds, the length of the block window). No rule references a secret in plaintext; the zone id is elicited and stored via the applied secretsManagement companion. The manifest is the source of truth an operator applies via the wrangler or dashboard flow named in the guide; no committed script writes the rules to the live zone.",
+  "description": "The applying project holds its rate-limit rule set as a set of JSON documents under the elicited rate-limit-rules-dir (default cloudflare/rate-limits/), one file per rule per ADR-3703. Every manifest file declares the seven required documented fields the Cloudflare WAF rate-limiting rules contract names per https://developers.cloudflare.com/waf/rate-limiting-rules/: id (a stable operator-facing string), expression (the WAF rules-language expression string), threshold (positive integer), period (seconds), characteristics (non-empty array of stable characteristic strings), action (block or challenge or log or managed_challenge), duration (seconds, the length of the block window). No rule references a secret in plaintext; the zone id is elicited and stored via the applied secretsManagement companion. The manifest is the source of truth an operator applies via the wrangler or dashboard flow named in the guide; no committed script writes the rules to the live zone. Delivers the declared `edgeRateLimit` capability token: the shipped rules manifest is the source of truth an operator promotes to the live Cloudflare zone, so once the applying project ships one manifest file per rule the `edgeRateLimit` promise binds every request the zone answers.",
   "category": "functional",
   "domain": "edge",
   "priority": "must",
@@ -13,5 +13,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-07T22:00:00.000Z",
-  "updatedAt": "2026-09-07T22:00:00.000Z"
+  "updatedAt": "2026-09-10T00:00:00.000Z",
+  "deliveredBy": {
+    "tacId": "TAC-3701-edge-cloudflare-rate-limiting-manifest-schema",
+    "field": "interfaces.schema"
+  }
 }

package/blueprints/edge-cloudflare-rate-limiting/contributions/requirements/edge-cloudflare-rate-limiting-req-002.json

@@ -13,5 +13,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-07T22:00:00.000Z",
-  "updatedAt": "2026-09-07T22:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00.000Z",
+  "deliveredBy": {
+    "tacId": "TAC-3702-edge-cloudflare-rate-limiting-management-surface-doc",
+    "field": "interfaces.guide"
+  }
 }