rcf-lite 0.26.0 → 0.27.0

package/blueprints/edge-cloudflare-tunnel/README.md

@@ -1,6 +1,6 @@
 # edge-cloudflare-tunnel
 
-Round-7 T-3 core blueprint on the rcf-lite shelf. Bridges a service on a
+Core blueprint on the rcf-lite shelf. Bridges a service on a
 `cloudHost` (bare, systemd shape) or a `containerHost` (compose-service
 shape) to the Cloudflare edge through a Cloudflare Tunnel, with no
 public origin ports. When applied alongside `edge-cloudflare-access`
@@ -13,7 +13,6 @@ when applied without it the tunnel serves in public-hostname mode.
 - Capabilities: `["tunnelBridge"]`
 - Mints global topic: `edgeIngressBridge`
 - Contribution count: 5 REQs, 8 USs, 3 TACs, 3 ADRs, 5 probes
-- Consumers: ops-01 has no consumer today (SSH is the only inbound path). Estate consumer is the follow-on make-the-librarian-API-and-workspace-viewer-reachable-without-Mullvad work that `w-2026-09-06-dave-010` is expected to green-light. Blueprint acceptance never depends on that consumer; the ops-01 migration mints as a separate work item at that point (`w-2026-09-07-dave-004`).
 
 ## Five REQs
 
@@ -21,7 +20,7 @@ when applied without it the tunnel serves in public-hostname mode.
 |---|---|
 | edge-cloudflare-tunnel-REQ-001 | Connector install shape switches on applied `containerHost` (compose-service default; systemd-unit for bare `cloudHost`); `cloudflaredReady` fires on boot with connector id, region and version metadata. |
 | edge-cloudflare-tunnel-REQ-002 | Tunnel manifest schema at `cloudflare/tunnels/<name>.yaml` (uuid tunnel id, `credentialsFile.secretRef` reference, ingress rules with catch-all `http_status:404`). |
-| edge-cloudflare-tunnel-REQ-003 | No public origin ports on the host; T-1 firewall stays closed on 80/443 unless a reverse proxy is applied; manifest refuses ingress rules whose service URL binds to a host public interface. |
+| edge-cloudflare-tunnel-REQ-003 | No public origin ports on the host; the deploy-hetzner-server firewall stays closed on 80/443 unless a reverse proxy is applied; manifest refuses ingress rules whose service URL binds to a host public interface. |
 | edge-cloudflare-tunnel-REQ-004 | Access-gated composition: `zeroTrustGate` applied attaches `originRequest.access.aud`; absent omits the block and serves in public-hostname mode. |
 | edge-cloudflare-tunnel-REQ-005 | Credentials-file discipline (host mode 0o400, referenced via `secretRef`, not committed, grep-refuse, no leak in event bodies). |
 
@@ -33,7 +32,7 @@ The connector runtime is elicited via `connector-runtime` (ADR-4002) with
 - **compose-service** (default when `containerHost` is applied). The
   cloudflared container ships alongside the applying project services on
   the same web-net network. No host ports; restart `unless-stopped`;
-  logging driver aligned with the T-2 compose-host log-driver elicit.
+  logging driver aligned with the platform-docker-compose-host log-driver elicit.
   Fixture: `packages/rcf-lite/test/fixtures/hetzner-throwaway-server/cloudflared/compose-service/`.
 - **systemd-unit** (alternative for a bare `cloudHost`). The cloudflared
   binary is installed via the vendor package per the cloudflared
@@ -66,7 +65,7 @@ Example (compose-service, public-hostname mode):
 ```yaml
 tunnel: 00000000-0000-4000-8000-0000000012ab
 credentialsFile:
-  secretRef: hq-estate/CLOUDFLARE_TUNNEL_CREDENTIALS_MY_PROJECT
+  secretRef: vault/CLOUDFLARE_TUNNEL_CREDENTIALS_MY_PROJECT
 ingress:
   - hostname: my-app.example.com
     service: http://web:8080
@@ -121,7 +120,7 @@ elicited; see ADR-4003). The blueprint reads the sidecar at
 The `aud-presence-check` probe refuses when the gated variant drifts to
 omit the AUD block (defensive against silent degradation).
 
-Graceful degrade: when Access is not applied (T-4 absent from
+Graceful degrade: when Access is not applied (the `zeroTrustGate` capability is absent from
 `origin/main` or the applying project simply does not want the gate),
 the blueprint still ships in public-hostname mode. The probe assertion
 runs on both fixture variants so the shape flip is proven on every
@@ -129,9 +128,10 @@ reviewer boot.
 
 ## No-public-ports rule
 
-The T-1 firewall on a `cloudHost` allows 22 unconditionally and 80/443
-only when a reverse proxy is applied. A project applying only T-1 plus
-T-3 (no reverse proxy) declares zero 80/443 rules; the tunnel is the
+The deploy-hetzner-server firewall on a `cloudHost` allows 22 unconditionally and 80/443
+only when a reverse proxy is applied. A project applying only
+deploy-hetzner-server and edge-cloudflare-tunnel (no reverse proxy)
+declares zero 80/443 rules; the tunnel is the
 sole path from the edge to the origin. The manifest schema refuses
 ingress rules whose service URL binds to `0.0.0.0`, a non-loopback
 numeric IP, or an unresolvable shape.
@@ -140,7 +140,7 @@ numeric IP, or an unresolvable shape.
 
 - `tunnel-name` (string; default `probe`): the Cloudflare Tunnel name
   and the manifest filename under `cloudflare/tunnels/<name>.yaml`.
-- `cloudflare-zone-secret` (string; default `hq-estate/CLOUDFLARE_ZONE_ID`):
+  `security-secrets-management` reference to the Cloudflare zone the
   `security-secrets-management` reference to the Cloudflare zone the
   tunnel serves under.
 - `public-hostname-template` (string; default `<service>.<zone>`):
@@ -150,14 +150,14 @@ numeric IP, or an unresolvable shape.
 - `access-aud` (string; default empty): Access AUD tag for the gated
   shape. Presence toggles the gated shape when `zeroTrustGate` is
   applied.
-- `connector-runtime` (enum: `compose-service`, `systemd-unit`; default
+  `compose-service`): the connector runtime per ADR-4002.
   `compose-service`): the connector runtime per ADR-4002.
 
 ## Companions
 
-- `suggestedCompanions[logging]`: every `cloudflaredReady`,
   `tunnelConnectorUp`, `tunnelConnectorDown`, `ingressRuleReloaded` and
   `accessGateRefused` event writes through the applied logger.
+  `accessGateRefused` event writes through the applied logger.
 - `suggestedCompanions[errorHandling]`: a cloudflared exit, a JWT-check
   failure, an ingress-rule schema violation, a hostname-DNS-route API
   refusal constructs an internal error record.
@@ -173,28 +173,27 @@ under the repo root.
 - **manifest-schema-validate** (local). Anchors AC-tunnel-manifestSchema,
   AC-tunnel-noPublicOrigin, AC-tunnel-credentialsDiscipline. `accountBound: false`.
   Ajv-free walker over the shipped JSON schema; runs on all four
-  variants; refuses on `SIMULATE_MANIFEST_INVALID_TUNNEL_ID`,
   `SIMULATE_MANIFEST_CREDENTIALS_INLINE`, `SIMULATE_MANIFEST_MISSING_CATCHALL`,
   `SIMULATE_ORIGIN_PORT_OPEN`, `SIMULATE_EVENT_SECRECY_LEAK`.
-- **cloudflared-config-lint** (local). Anchors AC-tunnel-hostnameRoutes.
+  `SIMULATE_ORIGIN_PORT_OPEN`, `SIMULATE_EVENT_SECRECY_LEAK`.
+  `accountBound: false`. Runs `cloudflared tunnel --config <path> ingress validate`
   `accountBound: false`. Runs `cloudflared tunnel --config <path> ingress validate`
-  via a local binary or the vendor container image
+  `cloudflare/cloudflared:2026.8.3`; refuses on `SIMULATE_INGRESS_INVALID`.
   `cloudflare/cloudflared:2026.8.3`; refuses on `SIMULATE_INGRESS_INVALID`.
 - **aud-presence-check** (local). Anchors AC-tunnel-accessGated,
   AC-tunnel-accessGatedRefuse. `accountBound: false`. Reads the sidecar
   and the paired manifests; asserts the shape flips correctly; refuses
   on `SIMULATE_AUD_DROP` when the gated fixture drifts to open ingress.
 - **real-account-connector-healthy** (account-bound). Anchors
-  AC-tunnel-connectorHealthy. `accountBound: true` on
   `CI_HAS_CLOUDFLARE_ACCOUNT` AND `CI_HAS_HETZNER_ACCOUNT`. Without
-  both, records `accountBoundSkipped: true` and the aggregate flips to
+  `CI_HAS_CLOUDFLARE_ACCOUNT` AND `CI_HAS_HETZNER_ACCOUNT`. Without
+  `pass`.
   `pass`.
 - **real-account-tunnel-hostname-routes** (account-bound). Anchors
   AC-tunnel-hostnameRoutes (public sub-case) and AC-tunnel-accessGated
   (gated sub-case). `accountBound: true`. The public-hostname sub-case
   runs on `CI_HAS_CLOUDFLARE_ACCOUNT` + `CI_HAS_HETZNER_ACCOUNT`; the
-  access-gated sub-case adds `CI_HAS_CLOUDFLARE_ACCESS` per the round-7
-  Q4 ratification. Sub-cases skip independently.
+  access-gated sub-case adds `CI_HAS_CLOUDFLARE_ACCESS`. Sub-cases skip independently.
 
 The delegate shims at
 `packages/rcf-lite/test/fixtures/hetzner-throwaway-server/run-<probe>.mjs`
@@ -208,7 +207,7 @@ The fixture lives under
 `packages/rcf-lite/test/fixtures/hetzner-throwaway-server/cloudflared/`:
 
 - `compose-service/compose-fragment.yaml`: the cloudflared compose
-  service alongside the T-2 web and caddy services.
+  service alongside the compose-host web and caddy services.
 - `systemd-unit/cloudflared.service`: the systemd unit per the vendor
   as-a-service docs.
 - `<runtime>/cloudflare/tunnels/public-hostname.yaml`: manifest without
@@ -217,7 +216,7 @@ The fixture lives under
   AUD block on every non-catch-all rule.
 - `<runtime>/credentials/probe.json.example`: placeholder credentials
   documenting the 0o400 mode discipline.
-- `sidecars/access-gated.applied.json`: `appliedCapabilities` includes
+  `zeroTrustGate`.
   `zeroTrustGate`.
 - `sidecars/public-hostname.applied.json`: `appliedCapabilities`
   excludes `zeroTrustGate`.

package/blueprints/edge-cloudflare-tunnel/blueprint.json

@@ -1,6 +1,6 @@
 {
   "slug": "edge-cloudflare-tunnel",
-  "version": "1.0.1",
+  "version": "1.1.3",
   "category": "edge",
   "capabilities": [
     "tunnelBridge"
@@ -26,7 +26,7 @@
       "id": "cloudflare-zone-secret",
       "prompt": "security-secrets-management reference to the Cloudflare zone the tunnel serves under. Read at apply time to create the DNS route; never inlined into the manifest.",
       "kind": "string",
-      "default": "hq-estate/CLOUDFLARE_ZONE_ID"
+      "default": "vault/CLOUDFLARE_ZONE_ID"
     },
     {
       "id": "public-hostname-template",
@@ -42,13 +42,13 @@
     },
     {
       "id": "access-aud",
-      "prompt": "Optional Access AUD tag for the Access-gated shape. When present AND edge-cloudflare-access is applied (zeroTrustGate on appliedCapabilities), every ingress rule attaches originRequest.access.aud with this value. When absent OR edge-cloudflare-access is not applied, the block is omitted and the tunnel serves in public-hostname mode.",
+      "prompt": "Access AUD tag. When edge-cloudflare-access is applied (zeroTrustGate on appliedCapabilities) this value is MANDATORY: every ingress rule attaches originRequest.access.aud with it and cloudflared refuses any request without a valid Access JWT for that AUD. Apply refuses with code apply.tunnel-aud-missing if zeroTrustGate is applied and this value is blank. When edge-cloudflare-access is NOT applied the block is omitted and the tunnel serves in the deliberate public-hostname mode per ADR-4003.",
       "kind": "string",
       "default": ""
     },
     {
       "id": "connector-runtime",
-      "prompt": "Connector runtime per ADR-4002. compose-service is the shipped default when containerHost is applied (T-2 platform-docker-compose-host on top of T-1 deploy-hetzner-server); systemd-unit is the alternative for a bare cloudHost per the cloudflared as-a-service local-configuration-file docs.",
+      "prompt": "Connector runtime per ADR-4002. compose-service is the shipped default when containerHost is applied (via platform-docker-compose-host on top of deploy-hetzner-server); systemd-unit is the alternative for a bare cloudHost per the cloudflared as-a-service local-configuration-file docs.",
       "kind": "enum",
       "options": [
         "compose-service",
@@ -163,6 +163,31 @@
       "recommendedDefault": true,
       "elicited": false,
       "standardsTraceClause": "Cloudflare Access self-hosted-public-app documented shape per hetzner-round-7-spec-2026-09-07.md"
+    },
+    {
+      "id": "edge-cloudflare-tunnel-REQ-006",
+      "kind": "req",
+      "path": "requirements/edge-cloudflare-tunnel-req-006.json"
+    },
+    {
+      "id": "edge-cloudflare-tunnel-REQ-007",
+      "kind": "req",
+      "path": "requirements/edge-cloudflare-tunnel-req-007.json"
+    },
+    {
+      "id": "edge-cloudflare-tunnel-US-39109",
+      "kind": "us",
+      "path": "user-stories/edge-cloudflare-tunnel-us-39109.json"
+    },
+    {
+      "id": "edge-cloudflare-tunnel-US-39110",
+      "kind": "us",
+      "path": "user-stories/edge-cloudflare-tunnel-us-39110.json"
+    },
+    {
+      "id": "TAC-4004-edge-cloudflare-tunnel-zone-and-hostname-apply",
+      "kind": "tac",
+      "path": "tacs/tac-4004-edge-cloudflare-tunnel-zone-and-hostname-apply.json"
     }
   ]
 }

package/blueprints/edge-cloudflare-tunnel/contributions/adrs/adr-4001-edge-cloudflare-tunnel-ingress-bridge-contract.json

@@ -5,13 +5,13 @@
   "version": "1.0.0",
   "status": "accepted",
   "title": "Edge ingress bridge contract: Cloudflare Tunnel as the shipped ingress-bridge shape from a cloudHost service to the CF edge (scope global, new topic edgeIngressBridge)",
-  "context": "An applying project running on a Linux cloudHost needs one shipped answer to the question of how a service on that host reaches the public internet without opening origin ports. Round-7 T-3 mints the edgeIngressBridge topic on this ADR. Cloudflare Tunnel is the shipped v1.0.0 mechanism (cloudflared connector out to the CF edge; DNS route on a Cloudflare zone; ingress rules mapping public hostname to internal service URL). Every applied ingress bridge needs one project-wide answer to the edgeIngressBridge topic; a future non-Cloudflare sibling (Tailscale Funnel, Fly.io proxy) would contribute the same topic string with a different mechanism, forcing a DELIBERATE conflict the operator resolves per the round-2 conflict pattern. Standards trace clause: Cloudflare Tunnel overview and get-started documented mechanics per hetzner-round-7-spec-2026-09-07.md.",
+  "context": "An applying project running on a Linux cloudHost needs one shipped answer to the question of how a service on that host reaches the public internet without opening origin ports. This blueprint mints the edgeIngressBridge topic on this ADR. Cloudflare Tunnel is the shipped v1.0.0 mechanism (cloudflared connector out to the CF edge; DNS route on a Cloudflare zone; ingress rules mapping public hostname to internal service URL). Every applied ingress bridge needs one project-wide answer to the edgeIngressBridge topic; a future non-Cloudflare sibling (Tailscale Funnel, Fly.io proxy) would contribute the same topic string with a different mechanism, forcing a DELIBERATE conflict the operator resolves per the round-2 conflict pattern. Standards trace clause: Cloudflare Tunnel overview and get-started documented mechanics per hetzner-round-7-spec-2026-09-07.md.",
   "decision": "The shipped v1.0.0 default is a Cloudflare Tunnel connector as the edgeIngressBridge provider. A cloudflared connector on the applying host (compose service by default when containerHost is applied per ADR-4002; systemd unit on a bare cloudHost) reads a tunnel manifest at cloudflare/tunnels/<name>.yaml and terminates ingress at the CF edge. The edgeIngressBridge topic scope is global on this blueprint; the topic string is edgeIngressBridge (lower camelCase, one concept per topic, no version suffix, per the round-2 rules-for-new-topics clause on the shelf registry). Standards trace clause: Cloudflare Tunnel overview and get-started documented mechanics per hetzner-round-7-spec-2026-09-07.md.",
-  "consequences": "Consumer blueprints that expose a service publicly declare capabilities: [tunnelBridge] on their applied contract to know a bridge is in place. Composition with zeroTrustGate (edge-cloudflare-access) toggles the Access-gated ingress shape per ADR-4003. A T-3-only project (no reverse proxy) declares no 80/443 firewall rule; the tunnel is the sole path from the edge to the origin. Rebuild-from-manifest is always possible: the manifest is the source of truth, the running connector is derivative. Folding this shape into edge-cloudflare-access was rejected: Access is an authorisation gate, Tunnel is an ingress bridge; the responsibilities are distinct and one applies without the other.",
+  "consequences": "Consumer blueprints that expose a service publicly declare capabilities: [tunnelBridge] on their applied contract to know a bridge is in place. Composition with zeroTrustGate (edge-cloudflare-access) toggles the Access-gated ingress shape per ADR-4003. A tunnel-only project (no reverse proxy) declares no 80/443 firewall rule; the tunnel is the sole path from the edge to the origin. Rebuild-from-manifest is always possible: the manifest is the source of truth, the running connector is derivative. Folding this shape into edge-cloudflare-access was rejected: Access is an authorisation gate, Tunnel is an ingress bridge; the responsibilities are distinct and one applies without the other.",
   "alternativesConsidered": [
     {
       "name": "Fold into edge-cloudflare-access as an adapter",
-      "reason": "Access is an authorisation gate on top of an ingress; Tunnel is an ingress bridge. One applies without the other. Folding conflated two decisions the operator ships separately. Rejected per Baz ruling decision 21."
+      "reason": "Access is an authorisation gate on top of an ingress; Tunnel is an ingress bridge. One applies without the other. Folding conflated two decisions the operator ships separately. Rejected during round-7 blueprint-scope definition."
     },
     {
       "name": "Ship a Tailscale Funnel or Fly.io proxy sibling in the same PR",
@@ -19,5 +19,5 @@
     }
   ],
   "createdAt": "2026-09-08T00:00:00.000Z",
-  "updatedAt": "2026-09-08T00:00:00.000Z"
+  "updatedAt": "2026-09-09T13:30:00.000Z"
 }

package/blueprints/edge-cloudflare-tunnel/contributions/adrs/adr-4002-edge-cloudflare-tunnel-connector-runtime.json

@@ -6,7 +6,7 @@
   "status": "accepted",
   "title": "Connector runtime: compose-service default when containerHost applied; systemd-unit alternative on bare cloudHost",
   "context": "The cloudflared connector runs in one of two supported vendor shapes: as a container image published on the cloudflared downloads page, or as a systemd unit installed via the vendor package per the cloudflared as-a-service local-configuration-file docs. An applying project running its stack under docker compose has a natural home for the connector alongside its other services (same network, same logging driver, same restart policy). An applying project running bare on the host has no compose stack and needs a systemd unit for boot ordering and journald logging. Standards trace clause: Cloudflare cloudflared as-a-service documented systemd unit per hetzner-round-7-spec-2026-09-07.md.",
-  "decision": "The connector runtime is elicited via connector-runtime with enum {compose-service, systemd-unit} and recommendedDefault compose-service. When the containerHost capability is applied (T-2 platform-docker-compose-host) the shipped default is compose-service; when the host runs bare (only T-1 applied) the operator picks systemd-unit at apply time. Standards trace clause: Cloudflare cloudflared as-a-service documented systemd unit per hetzner-round-7-spec-2026-09-07.md.",
+  "decision": "The connector runtime is elicited via connector-runtime with enum {compose-service, systemd-unit} and recommendedDefault compose-service. When the containerHost capability is applied (via platform-docker-compose-host) the shipped default is compose-service; when the host runs bare (only deploy-hetzner-server applied) the operator picks systemd-unit at apply time. Standards trace clause: Cloudflare cloudflared as-a-service documented systemd unit per hetzner-round-7-spec-2026-09-07.md.",
   "consequences": "The fixture ships both variants and both pass the local probes (manifest-schema-validate, cloudflared-config-lint, aud-presence-check). A future non-Cloudflare tunnel sibling (Tailscale Funnel, Fly.io proxy) reuses the runtime enum shape but the elicit lives on that sibling own ADR (conflict-by-design on edgeIngressBridge per ADR-4001). The systemd variant carries an install caveat in the guide: the vendor package landed via apt or curl per the as-a-service docs, which is out of scope for the blueprint itself.",
   "alternativesConsidered": [
     {

package/blueprints/edge-cloudflare-tunnel/contributions/probes/manifest-schema-validate.mjs

@@ -82,7 +82,7 @@ function validateAgainstSchema(doc, schema) {
 
 function refuseOriginPortRules(doc) {
   // A service URL that binds to a host public interface is a policy
-  // violation for a T-3 apply (no reverse proxy). The catch-all
+  // violation for a tunnel-only apply (no reverse proxy). The catch-all
   // http_status:N is exempt.
   const violations = [];
   const rules = Array.isArray(doc.ingress) ? doc.ingress : [];
@@ -97,11 +97,11 @@ function refuseOriginPortRules(doc) {
     }
     const host = m[1];
     if (host === '0.0.0.0' || host === '') {
-      violations.push(`ingress[${i}] service '${svc}' binds to a host public interface (${host || 'empty'}); T-3 requires internal addresses only`);
+      violations.push(`ingress[${i}] service '${svc}' binds to a host public interface (${host || 'empty'}); tunnel-only apply requires internal addresses only`);
       continue;
     }
     if (/^\d+\.\d+\.\d+\.\d+$/.test(host) && host !== '127.0.0.1') {
-      violations.push(`ingress[${i}] service '${svc}' binds to a numeric IP that is not loopback; T-3 requires internal names or loopback`);
+      violations.push(`ingress[${i}] service '${svc}' binds to a numeric IP that is not loopback; tunnel-only apply requires internal names or loopback`);
     }
   }
   return violations;

package/blueprints/edge-cloudflare-tunnel/contributions/probes/probe-utils.mjs

@@ -1,4 +1,4 @@
-// Shared helpers for edge-cloudflare-tunnel probes (round-7 T-3).
+// Shared helpers for edge-cloudflare-tunnel probes (round-7 edge).
 //
 // Runtime-dependency posture:
 // - manifest-schema-validate is dependency-free: it reads yaml text and
@@ -122,11 +122,22 @@ export async function runShim(probeName, engine, mainFn) {
 }
 
 export function accountBoundSkippedResult(anchorAcId, envList, note) {
+  // Positive-evidence rule (authoring standard section 7d): a probe that
+  // records `accountBoundSkipped: true` carries a `reason` field naming
+  // the exact env var(s) that were unset. Compute from process.env so
+  // the reason is a fact of the run, not a hand-copied string.
+  const unset = envList.filter((name) => process.env[name] !== 'true');
+  const reason = unset.length > 0 ? unset.join(', ') : envList.join(', ');
+  // Detail names only the variables actually missing, so a partial-skip
+  // (one first-tier gate set, the other unset) reads honestly instead of
+  // claiming the whole input list is unset.
+  const detailUnset = unset.length > 0 ? unset : envList;
   return {
     anchorAcId,
     verdict: 'skipped',
     accountBoundSkipped: true,
-    detail: `accountBound: ${envList.join(' or ')} unset; ${note}`,
+    reason,
+    detail: `accountBound: ${detailUnset.join(' or ')} unset; ${note}`,
   };
 }
 

package/blueprints/edge-cloudflare-tunnel/contributions/probes/real-account-connector-healthy.mjs

@@ -2,14 +2,13 @@
 //
 // anchorAcId: AC-tunnel-connectorHealthy (US-39102 contribution;
 // real-account-connector-healthy declared with tunnelConnectorUp).
-// C4 ruling: the AC-tunnel-* symbolic anchors on the tunnel blueprint
-// ARE the AC ids in the shipped US-39101..US-39108 contribution band
-// (see blueprints/edge-cloudflare-tunnel/contributions/user-stories/
+// The AC-tunnel-* symbolic anchors on this blueprint ARE the AC ids
+// in the shipped US-39101..US-39108 contribution band (see
+// blueprints/edge-cloudflare-tunnel/contributions/user-stories/
 // edge-cloudflare-tunnel-us-3910N.json); the anchors already resolve
-// to the shipped band, so no re-anchor is performed by H-2. The kv
-// treatment differed because those probes anchored AC-5xxx ids that
-// existed nowhere on the shelf; here the ids exist and match by
-// design.
+// to the shipped band, so no re-anchor is needed. The kv treatment
+// differed because those probes anchored AC-5xxx ids that existed
+// nowhere on the shelf; here the ids exist and match by design.
 //
 // accountBound: true (gates on CI_HAS_CLOUDFLARE_ACCOUNT AND
 // CI_HAS_HETZNER_ACCOUNT; the connector runs on a throwaway Hetzner
@@ -17,7 +16,7 @@
 //
 // Env-absent branch: pass-with-skip (spec section 3.5).
 // Env-present branch: provisions a throwaway Hetzner server through
-// the shared T-1 fixture provisionThrowawayServer, drives the
+// the shared throwaway-server fixture provisionThrowawayServer, drives the
 // cloudflared control surface through the cf-edge shim's
 // cloudflaredTunnelInfo({ tunnelName }) call, asserts at least one
 // HEALTHY connector, and captures a tunnelConnectorUp event
@@ -28,7 +27,7 @@
 //
 // The shim seams (cloudflaredTunnelInfo, event capture) allow the
 // driver path and mutation switches to be exercised locally without
-// a real Cloudflare account; the real-account run happens at HQ
+// a real Cloudflare account; the real-account run happens in the operator account
 // gate time.
 
 import { runShim, accountBoundSkippedResult } from './probe-utils.mjs';

package/blueprints/edge-cloudflare-tunnel/contributions/probes/real-account-tunnel-hostname-routes.mjs

@@ -1,6 +1,6 @@
 // Probe: real-account-tunnel-hostname-routes.
 //
-// anchorAcId list (unchanged per H-2 C4 ruling; the AC-tunnel-* ids
+// anchorAcId list (the AC-tunnel-* ids
 // ARE the shipped AC ids in the US-39104 / US-39106 contribution
 // bodies):
 // - AC-tunnel-hostnameRoutes (public-hostname sub-case: ingress rule
@@ -16,7 +16,7 @@
 // - Access-gated sub-case activated only when CI_HAS_CLOUDFLARE_ACCESS
 //   is ALSO set. Env-absent branch keeps pass-with-skip; a pass must
 //   never be reachable from CI_HAS_CLOUDFLARE_ACCOUNT presence alone.
-// - HQ note: Cloudflare Access is not enabled on the HQ account, so
+// - Deployment note: Cloudflare Access is not enabled on the operator account, so
 //   at gate time the AUD sub-case stays pass-with-skip; expected,
 //   not a driver defect.
 //

package/blueprints/edge-cloudflare-tunnel/contributions/requirements/edge-cloudflare-tunnel-req-001.json

@@ -2,7 +2,7 @@
   "reqId": "edge-cloudflare-tunnel-REQ-001",
   "prdId": "PRD-001",
   "title": "Connector install shape switches on applied containerHost (compose-service default; systemd-unit for bare cloudHost); cloudflaredReady fires on boot",
-  "description": "The blueprint contributes a cloudflared connector whose runtime shape is elicited via ADR-4002 with enum {compose-service, systemd-unit} and recommendedDefault compose-service. When containerHost is applied (T-2 platform-docker-compose-host on top of T-1 deploy-hetzner-server) the connector ships as a compose service alongside the applying project services on the same web-net network. When the host runs bare (only T-1 applied) the connector ships as a systemd unit per the vendor local-configuration-file docs. Either shape emits cloudflaredReady on boot with connector id, region and version metadata (metadata only; no token or credentials in the payload).",
+  "description": "The blueprint contributes a cloudflared connector whose runtime shape is elicited via ADR-4002 with enum {compose-service, systemd-unit} and recommendedDefault compose-service. When containerHost is applied (via platform-docker-compose-host on top of deploy-hetzner-server) the connector ships as a compose service alongside the applying project services on the same web-net network. When the host runs bare (only deploy-hetzner-server applied) the connector ships as a systemd unit per the vendor local-configuration-file docs. Either shape emits cloudflaredReady on boot with connector id, region and version metadata (metadata only; no token or credentials in the payload). Names the declared `tunnelBridge` capability token: the connector shape is the runtime that supplies the token, so once the applying project boots either variant the `tunnelBridge` promise is live.",
   "category": "functional",
   "domain": "edge",
   "priority": "must",
@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-08T00:00:00.000Z",
-  "updatedAt": "2026-09-08T00:00:00.000Z"
+  "updatedAt": "2026-09-10T00:00:00.000Z",
+  "deliveredBy": {
+    "tacId": "TAC-4001-edge-cloudflare-tunnel-connector-shape",
+    "field": "responsibilities.cloudflaredReady"
+  }
 }

package/blueprints/edge-cloudflare-tunnel/contributions/requirements/edge-cloudflare-tunnel-req-002.json

@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-08T00:00:00.000Z",
-  "updatedAt": "2026-09-08T00:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00.000Z",
+  "deliveredBy": {
+    "tacId": "TAC-4002-edge-cloudflare-tunnel-manifest-schema",
+    "field": "responsibilities.manifestSchema"
+  }
 }

package/blueprints/edge-cloudflare-tunnel/contributions/requirements/edge-cloudflare-tunnel-req-003.json

@@ -1,8 +1,8 @@
 {
   "reqId": "edge-cloudflare-tunnel-REQ-003",
   "prdId": "PRD-001",
-  "title": "No public origin ports on the host (T-1 firewall stays 22 open plus 80/443 only when a reverse proxy is applied; manifest refuses an origin-port request)",
-  "description": "The applying project MUST NOT open a public port on the host firewall for the origin path when only edge-cloudflare-tunnel provides ingress. T-1 deploy-hetzner-server firewall allows 22 unconditionally and 80/443 only when a reverse proxy is applied. A project applying only T-1 plus T-3 (no reverse proxy) declares zero 80/443 rules; the tunnel manifest schema refuses ingress rules whose service URL binds to a host public interface.",
+  "title": "No public origin ports on the host (the deploy-hetzner-server firewall stays 22 open plus 80/443 only when a reverse proxy is applied; manifest refuses an origin-port request)",
+  "description": "The applying project MUST NOT open a public port on the host firewall for the origin path when only edge-cloudflare-tunnel provides ingress. The deploy-hetzner-server firewall allows 22 unconditionally and 80/443 only when a reverse proxy is applied. A project applying only deploy-hetzner-server and edge-cloudflare-tunnel (no reverse proxy) declares zero 80/443 rules; the tunnel manifest schema refuses ingress rules whose service URL binds to a host public interface.",
   "category": "functional",
   "domain": "edge",
   "priority": "must",
@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-08T00:00:00.000Z",
-  "updatedAt": "2026-09-08T00:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00.000Z",
+  "deliveredBy": {
+    "tacId": "TAC-4002-edge-cloudflare-tunnel-manifest-schema",
+    "field": "responsibilities.noPublicOrigin"
+  }
 }

package/blueprints/edge-cloudflare-tunnel/contributions/requirements/edge-cloudflare-tunnel-req-004.json

@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-08T00:00:00.000Z",
-  "updatedAt": "2026-09-08T00:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00.000Z",
+  "deliveredBy": {
+    "tacId": "TAC-4003-edge-cloudflare-tunnel-access-binding",
+    "field": "responsibilities.accessGated"
+  }
 }

package/blueprints/edge-cloudflare-tunnel/contributions/requirements/edge-cloudflare-tunnel-req-005.json

@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-08T00:00:00.000Z",
-  "updatedAt": "2026-09-08T00:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00.000Z",
+  "deliveredBy": {
+    "tacId": "TAC-4002-edge-cloudflare-tunnel-manifest-schema",
+    "field": "responsibilities.credentialsDiscipline"
+  }
 }

package/blueprints/edge-cloudflare-tunnel/contributions/requirements/edge-cloudflare-tunnel-req-006.json

@@ -0,0 +1,22 @@
+{
+  "reqId": "edge-cloudflare-tunnel-REQ-006",
+  "prdId": "PRD-001",
+  "title": "Zone resolution and AUD-mandatory-when-gated: elicited cloudflare-zone-secret resolves via the vault seam; access-aud is mandatory whenever zeroTrustGate is applied",
+  "description": "At apply time the elicited cloudflare-zone-secret (a security-secrets-management reference) is resolved via the applied vault seam. The plaintext zone id never lands on disk in the applying tree; only a secretRef reaches the manifest and the applied sidecar. An unresolved reference refuses apply with code apply.zone-unresolved. A Cloudflare API 4xx on the tunnel-route call for the resolved zone refuses apply with code apply.zone-unauthorised. Additionally, when zeroTrustGate is present on appliedCapabilities, the elicited access-aud MUST be non-blank; apply refuses with code apply.tunnel-aud-missing otherwise (never a silent public-hostname fallback under an applied gate).",
+  "category": "security",
+  "domain": "edge",
+  "priority": "must",
+  "rationale": "Closes the review P0 F-1 (elicit collected and ignored) and specimen F-3 (access-aud silent-degrade precedence). Aligns the zone-secret elicit with security-secrets-management discipline; ties the AUD-mandatory reading of REQ-004 to a machine-observable apply refusal.",
+  "tags": [
+    "blueprint:edge-cloudflare-tunnel",
+    "capability:tunnelBridge"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-09T00:00:00.000Z",
+  "updatedAt": "2026-09-09T00:00:00.000Z",
+  "deliveredBy": {
+    "tacId": "TAC-4004-edge-cloudflare-tunnel-zone-and-hostname-apply",
+    "field": "responsibilities.zoneResolve"
+  }
+}

package/blueprints/edge-cloudflare-tunnel/contributions/requirements/edge-cloudflare-tunnel-req-007.json

@@ -0,0 +1,22 @@
+{
+  "reqId": "edge-cloudflare-tunnel-REQ-007",
+  "prdId": "PRD-001",
+  "title": "Public-hostname template expansion at apply: inputs, output, malformed refusal and duplicate refusal",
+  "description": "The elicited public-hostname-template (default <service>.<zone>) is expanded per ingress rule at apply time. Substitution inputs are exactly two placeholders: <service> (the ingress rule service name) and <zone> (the resolved zone domain). The output is a fully-qualified DNS name committed to the ingress rule and to the applied sidecar. A template with an undefined placeholder, an unclosed brace, or a rendered value that violates DNS label rules (labels longer than 63 chars, empty labels, characters outside [a-z0-9-]) refuses apply with code apply.hostname-template-malformed. Two ingress rules expanding to the same concrete hostname refuses apply with code apply.hostname-template-duplicate.",
+  "category": "functional",
+  "domain": "edge",
+  "priority": "must",
+  "rationale": "Closes review P0 F-2 (hostname-template elicit collected and ignored). Names the substitution inputs, the output, the malformed refusal and the duplicate refusal so apply can bind each failure mode to an AC.",
+  "tags": [
+    "blueprint:edge-cloudflare-tunnel",
+    "capability:tunnelBridge"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-09T00:00:00.000Z",
+  "updatedAt": "2026-09-09T00:00:00.000Z",
+  "deliveredBy": {
+    "tacId": "TAC-4004-edge-cloudflare-tunnel-zone-and-hostname-apply",
+    "field": "responsibilities.hostnameTemplateExpand"
+  }
+}

package/blueprints/edge-cloudflare-tunnel/contributions/tacs/tac-4001-edge-cloudflare-tunnel-connector-shape.json

@@ -5,7 +5,7 @@
   "version": "1.0.0",
   "status": "approved",
   "name": "Edge-cloudflare-tunnel connector install shape",
-  "purpose": "The cloudflared connector installs in one of two runtime shapes as selected by ADR-4002 from the applied capability set. When containerHost is applied (T-2 platform-docker-compose-host on top of T-1 deploy-hetzner-server) the connector ships as a compose service alongside the applying project services on the same web-net network with no host ports and a healthcheck. When the host runs bare (only T-1 applied) the connector ships as a systemd unit per the vendor local-configuration-file docs. Either shape emits cloudflaredReady on boot with connector id, region and version metadata (metadata only).",
+  "purpose": "The cloudflared connector installs in one of two runtime shapes as selected by ADR-4002 from the applied capability set. When containerHost is applied (via platform-docker-compose-host on top of deploy-hetzner-server) the connector ships as a compose service alongside the applying project services on the same web-net network with no host ports and a healthcheck. When the host runs bare (only deploy-hetzner-server applied) the connector ships as a systemd unit per the vendor local-configuration-file docs. Either shape emits cloudflaredReady on boot with connector id, region and version metadata (metadata only).",
   "responsibilities": [
     "Ship the compose-service variant under packages/rcf-lite/test/fixtures/hetzner-throwaway-server/cloudflared/compose-service/ (AC-tunnel-connectorShape).",
     "Ship the systemd-unit variant under packages/rcf-lite/test/fixtures/hetzner-throwaway-server/cloudflared/systemd-unit/ (AC-tunnel-connectorShape).",

package/blueprints/edge-cloudflare-tunnel/contributions/tacs/tac-4004-edge-cloudflare-tunnel-zone-and-hostname-apply.json

@@ -0,0 +1,29 @@
+{
+  "tacId": "TAC-4004-edge-cloudflare-tunnel-zone-and-hostname-apply",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "name": "Zone resolution and public-hostname template expansion at apply",
+  "purpose": "The apply-verb path in the blueprint reads the elicited cloudflare-zone-secret (a security-secrets-management reference resolved at apply time), fetches the zone id via the vault seam, and never inlines the identifier into a manifest. The same apply pass expands the elicited public-hostname-template (default <service>.<zone>) per ingress rule to produce concrete hostnames. Apply refuses on: unresolved zone reference, unauthorised zone (Cloudflare API returns 4xx on the tunnel-route call), malformed hostname template, duplicate expanded hostnames across ingress rules. The DNS route for each expanded hostname is created via the Cloudflare API tunnels-routes endpoint or validated to already exist; a failed route creation refuses apply. This TAC anchors AC-tunnel-zoneResolve, AC-tunnel-zoneUnauthorised, AC-tunnel-hostnameTemplateExpand, AC-tunnel-hostnameTemplateMalformed, AC-tunnel-hostnameTemplateDuplicate and AC-tunnel-audMandatoryWhenGated.",
+  "responsibilities": [
+    "Resolve the elicited cloudflare-zone-secret via the security-secrets-management vault seam at apply; refuse apply.zone-unresolved when the reference does not resolve (AC-tunnel-zoneResolve).",
+    "Never inline the resolved zone id into the tunnel manifest or the applied sidecar in plaintext; only a secretRef reaches disk (AC-tunnel-zoneResolve).",
+    "Refuse apply.zone-unauthorised when the Cloudflare API returns 4xx on the tunnel-route call for the resolved zone (AC-tunnel-zoneUnauthorised).",
+    "Expand the elicited public-hostname-template per ingress rule to produce concrete hostnames; template inputs are {service, zone} and the output is the fully-qualified hostname the ingress rule commits to (AC-tunnel-hostnameTemplateExpand).",
+    "Refuse apply.hostname-template-malformed when the template contains an undefined placeholder, an unclosed brace, or expands to an invalid DNS label (AC-tunnel-hostnameTemplateMalformed).",
+    "Refuse apply.hostname-template-duplicate when two or more ingress rules expand to the same concrete hostname (AC-tunnel-hostnameTemplateDuplicate).",
+    "Refuse apply.tunnel-aud-missing when zeroTrustGate is applied and the elicited access-aud is blank (AC-tunnel-audMandatoryWhenGated)."
+  ],
+  "internalStructure": "One apply-time module that reads the elicited zone and hostname template, resolves the zone via security-secrets-management, calls the Cloudflare API tunnel-route endpoint per expanded hostname, and writes the applied sidecar with the concrete hostnames plus a secretRef for the zone (never the plaintext zone id).",
+  "interfaces": [
+    {
+      "name": "resolveZoneAndExpandHostnames",
+      "kind": "facade",
+      "summary": "Apply-time facade returning the resolved zone secretRef and the array of concrete hostname expansions per ingress rule."
+    }
+  ],
+  "dependencies": [],
+  "createdAt": "2026-09-09T00:00:00.000Z",
+  "updatedAt": "2026-09-09T00:00:00.000Z"
+}

package/blueprints/edge-cloudflare-tunnel/contributions/user-stories/edge-cloudflare-tunnel-us-39101.json

@@ -11,14 +11,50 @@
   "acceptanceCriteria": [
     {
       "id": "AC-tunnel-connectorShape",
-      "description": "The applied fixture ships both variants under packages/rcf-lite/test/fixtures/hetzner-throwaway-server/cloudflared/{compose-service,systemd-unit}/; the compose-service variant defines a cloudflared service on the same web-net network as the T-2 web and caddy services with no host ports, restart unless-stopped and a healthcheck; the systemd-unit variant ships a cloudflared.service unit file per the vendor local-configuration-file docs.",
+      "description": "The applied fixture ships both variants under packages/rcf-lite/test/fixtures/hetzner-throwaway-server/cloudflared/{compose-service,systemd-unit}/; the compose-service variant defines a cloudflared service on the same web-net network as the compose-host web and caddy services with no host ports, restart unless-stopped and a healthcheck; the systemd-unit variant ships a cloudflared.service unit file per the vendor local-configuration-file docs.",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-4001-edge-cloudflare-tunnel-connector-shape",
+        "field": "responsibilities.compose-service"
+      },
+      "given": "the applied fixture at packages/rcf-lite/test/fixtures/hetzner-throwaway-server/cloudflared/ with the compose-service and systemd-unit variants both present",
+      "when": "the anatomy test walks the fixture tree and reads each variant shape",
+      "then": "the compose-service variant defines a cloudflared service on the web-net network with no host ports, restart unless-stopped and a healthcheck; the systemd-unit variant ships a cloudflared.service unit file per the vendor local-configuration-file docs"
+    },
+    {
+      "id": "AC-tunnel-connectorPrecedence",
+      "description": "Given the elicited connector-runtime and the applied capability set, precedence is: applied containerHost + elicit \"compose-service\" -> compose-service variant; bare cloudHost (no containerHost) + elicit \"systemd-unit\" -> systemd-unit variant; applied containerHost + elicit \"systemd-unit\" refuses at apply with code apply.connector-runtime-incompatible naming both the applied capability and the elicit value; bare cloudHost + elicit \"compose-service\" refuses at apply with the same code.",
+      "given": "the applied fixture with the four combinations of containerHost applied/absent and elicited connector-runtime compose-service/systemd-unit",
+      "when": "the applying agent runs apply against each combination",
+      "then": "the two compatible combinations select the matching variant and the two incompatible combinations refuse with apply.connector-runtime-incompatible",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-4001-edge-cloudflare-tunnel-connector-shape",
+        "field": "interfaces.default"
+      }
+    },
+    {
+      "id": "AC-tunnel-capabilityToken",
+      "description": "The applied blueprint's manifest declares the `tunnelBridge` capability token, and the connector variant selected by the applied capability set (compose-service under containerHost; systemd-unit on a bare cloudHost) is present and boots per AC-tunnel-connectorShape; therefore the `tunnelBridge` capability the manifest promises is live at runtime.",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-4001-edge-cloudflare-tunnel-connector-shape",
+        "field": "responsibilities.cloudflaredReady"
+      },
+      "given": "the applied blueprint manifest at `blueprints/edge-cloudflare-tunnel/blueprint.json` and the applied connector variant on disk under the fixture at `packages/rcf-lite/test/fixtures/hetzner-throwaway-server/cloudflared/`",
+      "when": "the anatomy test reads `blueprint.json` and walks the fixture tree for the two variants",
+      "then": "the manifest carries `tunnelBridge` on its `capabilities[]` list and both connector variants are present on disk, so the applied project inherits a working `tunnelBridge` runtime"
     }
   ],
   "tacIds": [
     "TAC-4001-edge-cloudflare-tunnel-connector-shape"
   ],
   "createdAt": "2026-09-08T00:00:00.000Z",
-  "updatedAt": "2026-09-08T00:00:00.000Z"
+  "updatedAt": "2026-09-10T00:00:00.000Z"
 }