rcf-lite 0.26.0 → 0.27.0

package/blueprints/edge-cloudflare-tunnel/contributions/user-stories/edge-cloudflare-tunnel-us-39102.json

@@ -4,21 +4,40 @@
   "reqId": "edge-cloudflare-tunnel-REQ-001",
   "version": "1.0.0",
   "status": "approved",
-  "title": "Cloudflared connector reports healthy on boot (tunnelConnectorUp fires with connector id, region, version)",
+  "title": "Connector boots (cloudflaredReady) and each connector reports up (tunnelConnectorUp) with metadata-only payloads",
   "asA": "shelf consumer applying edge-cloudflare-tunnel v1.0.0 on a cloudHost",
-  "iWant": "the connector to emit a tunnelConnectorUp event on boot with connector id, region and version metadata (metadata only)",
+  "iWant": "the connector on boot to fire exactly one cloudflaredReady event with a metadata-only payload naming the connector id, region and version, and the real-account cloudflared tunnel info surface to fire a per-connector tunnelConnectorUp event once each connector is healthy",
   "soThat": "the observability sink proves the tunnel is up without a shell into the host",
   "acceptanceCriteria": [
     {
       "id": "AC-tunnel-connectorHealthy",
       "description": "real-account-connector-healthy probe declares accountBound true (on CI_HAS_CLOUDFLARE_ACCOUNT AND CI_HAS_HETZNER_ACCOUNT) and records accountBoundSkipped when either is unset. When both are set the probe drives cloudflared tunnel info against the fixture tunnel and asserts at least one healthy connector plus a tunnelConnectorUp event with connector id, region and version.",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-4001-edge-cloudflare-tunnel-connector-shape",
+        "field": "responsibilities.cloudflaredReady"
+      }
+    },
+    {
+      "id": "AC-tunnel-cloudflaredReady",
+      "description": "Given the connector on boot, exactly one cloudflaredReady event fires on the injected sink with a metadata-only payload {connectorId, region, version}; no token, credential, ingress rule literal or account tag appears in the payload; the payload is Object.frozen at the connector boundary; the tunnelConnectorUp per-tunnel event is a distinct, later event tied to cloudflared tunnel info and is not conflated with cloudflaredReady.",
+      "given": "the fixture connector wired to the injected event sink at process boot",
+      "when": "the connector process reaches boot-complete",
+      "then": "exactly one cloudflaredReady with the metadata-only payload fires and no credential or tunnel-id literal appears in the payload",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-4001-edge-cloudflare-tunnel-connector-shape",
+        "field": "responsibilities.cloudflaredReady"
+      }
     }
   ],
   "tacIds": [
     "TAC-4001-edge-cloudflare-tunnel-connector-shape"
   ],
   "createdAt": "2026-09-08T00:00:00.000Z",
-  "updatedAt": "2026-09-08T00:00:00.000Z"
+  "updatedAt": "2026-09-09T12:00:00.000Z"
 }

package/blueprints/edge-cloudflare-tunnel/contributions/user-stories/edge-cloudflare-tunnel-us-39103.json

@@ -11,14 +11,64 @@
   "acceptanceCriteria": [
     {
       "id": "AC-tunnel-manifestSchema",
-      "description": "manifest-schema-validate probe passes on the canonical fixture and fails when the fixture is mutated (SIMULATE_MANIFEST_INVALID_TUNNEL_ID, SIMULATE_MANIFEST_CREDENTIALS_INLINE, SIMULATE_MANIFEST_MISSING_CATCHALL) naming the offending field.",
+      "description": "Given the canonical fixture cloudflare/tunnels/<name>.yaml (uuid tunnel id, credentialsFile.secretRef reference, ingress array whose last entry is the catch-all `service: http_status:404`), when the manifest-schema-validate probe runs against the fixture, the probe returns aggregateVerdict:pass with zero findings.",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-4002-edge-cloudflare-tunnel-manifest-schema",
+        "field": "interfaces.schema"
+      },
+      "given": "the canonical fixture manifest with the three required-shape invariants (uuid tunnel id, credentialsFile.secretRef reference, terminal catch-all)",
+      "when": "manifest-schema-validate runs against the canonical fixture",
+      "then": "the probe returns aggregateVerdict:pass with zero findings"
+    },
+    {
+      "id": "AC-tunnel-manifestSchemaInvalidTunnelId",
+      "description": "Given the fixture manifest mutated via SIMULATE_MANIFEST_INVALID_TUNNEL_ID (tunnel id no longer a UUID), when manifest-schema-validate runs, the probe returns aggregateVerdict:fail and the detail names the offending field `tunnel` from the schema.",
+      "given": "the fixture cloudflare/tunnels/<name>.yaml mutated so tunnel is not a UUID (SIMULATE_MANIFEST_INVALID_TUNNEL_ID=true)",
+      "when": "manifest-schema-validate runs against the mutated fixture",
+      "then": "the probe returns aggregateVerdict:fail with detail naming the schema field `tunnel`",
+      "testable": true,
+      "scope": "library",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-4002-edge-cloudflare-tunnel-manifest-schema",
+        "field": "interfaces.schema"
+      }
+    },
+    {
+      "id": "AC-tunnel-manifestSchemaCredentialsInline",
+      "description": "Given the fixture manifest mutated via SIMULATE_MANIFEST_CREDENTIALS_INLINE (credentials JSON body inlined instead of the required credentialsFile.secretRef reference), when manifest-schema-validate runs, the probe returns aggregateVerdict:fail and the detail names the offending field `credentialsFile.secretRef`.",
+      "given": "the fixture manifest with credentials inlined as JSON rather than referenced by secretRef (SIMULATE_MANIFEST_CREDENTIALS_INLINE=true)",
+      "when": "manifest-schema-validate runs",
+      "then": "the probe returns aggregateVerdict:fail with detail naming the schema field `credentialsFile.secretRef`",
+      "testable": true,
+      "scope": "library",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-4002-edge-cloudflare-tunnel-manifest-schema",
+        "field": "responsibilities.credentialsSecretRef"
+      }
+    },
+    {
+      "id": "AC-tunnel-manifestSchemaMissingCatchall",
+      "description": "Given the fixture manifest mutated via SIMULATE_MANIFEST_MISSING_CATCHALL (last ingress rule is not the required `service: http_status:404` catch-all), when manifest-schema-validate runs, the probe returns aggregateVerdict:fail and the detail names the ingress array's terminal catch-all requirement.",
+      "given": "the fixture manifest with the terminal http_status:404 catch-all ingress rule removed (SIMULATE_MANIFEST_MISSING_CATCHALL=true)",
+      "when": "manifest-schema-validate runs",
+      "then": "the probe returns aggregateVerdict:fail with detail naming the ingress array's terminal `service: http_status:404` catch-all requirement",
+      "testable": true,
+      "scope": "library",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-4002-edge-cloudflare-tunnel-manifest-schema",
+        "field": "interfaces.schema"
+      }
     }
   ],
   "tacIds": [
     "TAC-4002-edge-cloudflare-tunnel-manifest-schema"
   ],
   "createdAt": "2026-09-08T00:00:00.000Z",
-  "updatedAt": "2026-09-08T00:00:00.000Z"
+  "updatedAt": "2026-09-09T13:00:00.000Z"
 }

package/blueprints/edge-cloudflare-tunnel/contributions/user-stories/edge-cloudflare-tunnel-us-39104.json

@@ -11,14 +11,44 @@
   "acceptanceCriteria": [
     {
       "id": "AC-tunnel-hostnameRoutes",
-      "description": "cloudflared-config-lint probe runs cloudflared tunnel ingress validate against the fixture manifest (through the cloudflare/cloudflared:2026.8.3 container image when the binary is not on PATH) and exits 0 on the canonical fixture; SIMULATE_INGRESS_INVALID rewrites the service URL to an unresolvable scheme and the probe FAILS.",
+      "description": "Given the canonical fixture manifest, when the cloudflared-config-lint probe runs `cloudflared tunnel ingress validate` (via the cloudflare/cloudflared:2026.8.3 container image when the binary is not on PATH) against the fixture manifest, the probe exits 0 and returns aggregateVerdict:pass.",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-4002-edge-cloudflare-tunnel-manifest-schema",
+        "field": "interfaces.schema"
+      },
+      "vendorCitation": {
+        "url": "https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/do-more-with-tunnels/local-management/configuration-file/",
+        "verifiedOn": "2026-09-09"
+      },
+      "given": "the canonical fixture manifest with a valid ingress ruleset",
+      "when": "cloudflared-config-lint runs `cloudflared tunnel ingress validate` against the fixture",
+      "then": "the probe exits 0 and returns aggregateVerdict:pass"
+    },
+    {
+      "id": "AC-tunnel-hostnameRoutesInvalidIngress",
+      "description": "Given the fixture manifest mutated via SIMULATE_INGRESS_INVALID (an ingress rule service URL rewritten to an unresolvable scheme), when cloudflared-config-lint runs `cloudflared tunnel ingress validate` against the mutated fixture, the probe exits non-zero and returns aggregateVerdict:fail with detail naming the offending ingress rule index.",
+      "given": "the fixture manifest with one ingress rule's service URL rewritten to an unresolvable scheme (SIMULATE_INGRESS_INVALID=true)",
+      "when": "cloudflared-config-lint runs against the mutated fixture",
+      "then": "the probe exits non-zero and returns aggregateVerdict:fail with detail naming the offending ingress rule index",
+      "testable": true,
+      "scope": "library",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-4002-edge-cloudflare-tunnel-manifest-schema",
+        "field": "interfaces.schema"
+      },
+      "vendorCitation": {
+        "url": "https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/do-more-with-tunnels/local-management/configuration-file/",
+        "verifiedOn": "2026-09-09"
+      }
     }
   ],
   "tacIds": [
     "TAC-4002-edge-cloudflare-tunnel-manifest-schema"
   ],
   "createdAt": "2026-09-08T00:00:00.000Z",
-  "updatedAt": "2026-09-08T00:00:00.000Z"
+  "updatedAt": "2026-09-09T13:00:00.000Z"
 }

package/blueprints/edge-cloudflare-tunnel/contributions/user-stories/edge-cloudflare-tunnel-us-39105.json

@@ -11,14 +11,36 @@
   "acceptanceCriteria": [
     {
       "id": "AC-tunnel-noPublicOrigin",
-      "description": "manifest-schema-validate refuses under SIMULATE_ORIGIN_PORT_OPEN when an ingress rule service URL binds to 0.0.0.0 or a host public interface; the T-1 firewall on the ci-throwaway manifest stays 22 open plus 80/443 open only when a reverse proxy is applied.",
+      "description": "Given the fixture manifest mutated via SIMULATE_ORIGIN_PORT_OPEN (one ingress rule service URL rewritten to bind to 0.0.0.0 or a host public interface), when manifest-schema-validate runs, the probe returns aggregateVerdict:fail with detail naming the offending ingress rule index. The deploy-hetzner-server firewall on the ci-throwaway manifest stays 22 open plus 80/443 open only when a reverse proxy is applied.",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-4002-edge-cloudflare-tunnel-manifest-schema",
+        "field": "responsibilities.originPortRefusal"
+      },
+      "given": "the fixture manifest with one ingress rule service URL bound to 0.0.0.0 or a host public interface (SIMULATE_ORIGIN_PORT_OPEN=true)",
+      "when": "manifest-schema-validate runs against the mutated fixture",
+      "then": "the probe returns aggregateVerdict:fail with detail naming the offending ingress rule index"
+    },
+    {
+      "id": "AC-tunnel-noPublicOriginHappy",
+      "description": "Given the canonical fixture manifest (every ingress rule's service URL binds to an internal address: a compose service name or a loopback interface), when manifest-schema-validate runs, the probe returns aggregateVerdict:pass with no origin-port findings.",
+      "given": "the canonical fixture manifest with every ingress rule bound to an internal service or loopback",
+      "when": "manifest-schema-validate runs on the canonical fixture",
+      "then": "the probe returns aggregateVerdict:pass with no origin-port findings",
+      "testable": true,
+      "scope": "library",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-4002-edge-cloudflare-tunnel-manifest-schema",
+        "field": "responsibilities.originPortRefusal"
+      }
     }
   ],
   "tacIds": [
     "TAC-4002-edge-cloudflare-tunnel-manifest-schema"
   ],
   "createdAt": "2026-09-08T00:00:00.000Z",
-  "updatedAt": "2026-09-08T00:00:00.000Z"
+  "updatedAt": "2026-09-09T13:00:00.000Z"
 }

package/blueprints/edge-cloudflare-tunnel/contributions/user-stories/edge-cloudflare-tunnel-us-39106.json

@@ -13,12 +13,96 @@
       "id": "AC-tunnel-accessGated",
       "description": "aud-presence-check probe reads each variant sidecar and asserts the ingress rules attach originRequest.access.aud on the access-gated variant and omit the block on the public-hostname variant. The shape flip is a pure function of the sidecar contents.",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-4003-edge-cloudflare-tunnel-access-binding",
+        "field": "responsibilities.audAttach"
+      },
+      "vendorCitation": {
+        "url": "https://developers.cloudflare.com/cloudflare-one/applications/configure-apps/self-hosted-public-app/",
+        "verifiedOn": "2026-09-09"
+      },
+      "given": "the fixture ships the access-gated and public-hostname sidecar variants under packages/rcf-lite/test/fixtures/hetzner-throwaway-server/cloudflared/ with the access-gated sidecar carrying an elicited AUD",
+      "when": "the aud-presence-check probe reads each variant sidecar's ingress rules",
+      "then": "the access-gated variant ingress rules all carry originRequest.access.aud and the public-hostname variant ingress rules all omit the originRequest.access block; the shape flip is a pure function of the sidecar contents"
+    },
+    {
+      "id": "AC-tunnel-accessGatedRejectMissing",
+      "description": "Given the access-gated variant on an account-bound run, when a request reaches the gated hostname with no Cf-Access-Jwt-Assertion header, cloudflared refuses at the edge and the origin never sees the request (the origin origin-hit counter stays at zero across N+1 requests). Applying agent sets: the applying agent sets the elicited access-aud tag and the applied project's Cf-Access-Jwt-Assertion signing team; the accept and reject observables are pure functions of that AUD.",
+      "given": "the account-bound fixture with an origin counter behind a gated hostname",
+      "when": "a client fires N+1 requests without a Cf-Access-Jwt-Assertion header",
+      "then": "every request is refused at the edge and the origin counter stays at zero",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-4003-edge-cloudflare-tunnel-access-binding",
+        "field": "responsibilities.accessGated"
+      },
+      "vendorCitation": {
+        "url": "https://developers.cloudflare.com/cloudflare-one/applications/configure-apps/self-hosted-public-app/",
+        "verifiedOn": "2026-09-09"
+      }
+    },
+    {
+      "id": "AC-tunnel-accessGatedRejectInvalid",
+      "description": "Given the access-gated variant, when a request reaches the gated hostname with a malformed or expired Cf-Access-Jwt-Assertion, cloudflared refuses at the edge and the origin origin-hit counter stays at zero across N+1 requests. Applying agent sets: the applying agent sets the elicited access-aud tag; the reject observable is a pure function of that AUD.",
+      "given": "the account-bound fixture with an origin counter behind a gated hostname",
+      "when": "a client fires N+1 requests with a malformed or expired Cf-Access-Jwt-Assertion",
+      "then": "every request is refused at the edge and the origin counter stays at zero",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-4003-edge-cloudflare-tunnel-access-binding",
+        "field": "responsibilities.accessGated"
+      },
+      "vendorCitation": {
+        "url": "https://developers.cloudflare.com/cloudflare-one/applications/configure-apps/self-hosted-public-app/",
+        "verifiedOn": "2026-09-09"
+      }
+    },
+    {
+      "id": "AC-tunnel-accessGatedRejectWrongAud",
+      "description": "Given the access-gated variant with an elicited AUD tag, when a request presents a well-signed Cf-Access-Jwt-Assertion whose aud claim does not match the elicited AUD, cloudflared refuses at the edge and the origin origin-hit counter stays at zero. Applying agent sets: the applying agent sets the elicited access-aud tag; a request whose JWT `aud` differs from the applied value is refused.",
+      "given": "the account-bound fixture with the elicited AUD tag configured",
+      "when": "a client fires a request with a well-signed JWT whose aud claim mismatches the elicited AUD",
+      "then": "the request is refused at the edge and the origin counter stays at zero",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-4003-edge-cloudflare-tunnel-access-binding",
+        "field": "responsibilities.accessGated"
+      },
+      "vendorCitation": {
+        "url": "https://developers.cloudflare.com/cloudflare-one/applications/configure-apps/self-hosted-public-app/",
+        "verifiedOn": "2026-09-09"
+      }
+    },
+    {
+      "id": "AC-tunnel-accessGatedAcceptValid",
+      "description": "Given the access-gated variant, when a request presents a well-signed Cf-Access-Jwt-Assertion whose aud claim matches the elicited AUD, the request reaches the origin exactly once and the origin origin-hit counter increments by one per accepted request. Applying agent sets: the applying agent sets the elicited access-aud tag; a request whose JWT `aud` matches the applied value is accepted.",
+      "given": "the account-bound fixture with the elicited AUD tag configured and an origin counter",
+      "when": "a client fires N requests each with a well-signed JWT whose aud matches the elicited AUD",
+      "then": "each request reaches the origin and the origin counter reads exactly N",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-4003-edge-cloudflare-tunnel-access-binding",
+        "field": "responsibilities.accessGated"
+      },
+      "vendorCitation": {
+        "url": "https://developers.cloudflare.com/cloudflare-one/applications/configure-apps/self-hosted-public-app/",
+        "verifiedOn": "2026-09-09"
+      }
     }
   ],
   "tacIds": [
     "TAC-4003-edge-cloudflare-tunnel-access-binding"
   ],
   "createdAt": "2026-09-08T00:00:00.000Z",
-  "updatedAt": "2026-09-08T00:00:00.000Z"
+  "updatedAt": "2026-09-09T13:00:00.000Z"
 }

package/blueprints/edge-cloudflare-tunnel/contributions/user-stories/edge-cloudflare-tunnel-us-39107.json

@@ -11,14 +11,36 @@
   "acceptanceCriteria": [
     {
       "id": "AC-tunnel-accessGatedRefuse",
-      "description": "aud-presence-check FAILS under SIMULATE_AUD_DROP when the gated fixture ingress drifts to omit the originRequest.access block. The finding names the affected rule and the missing AUD value.",
+      "description": "Given the gated fixture sidecar mutated via SIMULATE_AUD_DROP (one ingress rule drifts to omit the originRequest.access block), when aud-presence-check runs, the probe returns aggregateVerdict:fail with detail naming the affected ingress rule and the missing AUD value.",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-4003-edge-cloudflare-tunnel-access-binding",
+        "field": "responsibilities.audAttach"
+      },
+      "given": "the gated fixture sidecar with one ingress rule missing the originRequest.access block (SIMULATE_AUD_DROP=true)",
+      "when": "aud-presence-check runs on the mutated gated sidecar",
+      "then": "the probe returns aggregateVerdict:fail with detail naming the affected rule and the missing AUD value"
+    },
+    {
+      "id": "AC-tunnel-accessGatedRefuseHappy",
+      "description": "Given the canonical access-gated fixture sidecar (every non-catch-all ingress rule attaches the originRequest.access block with an AUD value), when aud-presence-check runs, the probe returns aggregateVerdict:pass with a zero-drift finding count on the gated variant.",
+      "given": "the canonical gated fixture sidecar with originRequest.access block attached on every non-catch-all rule",
+      "when": "aud-presence-check runs on the gated variant sidecar",
+      "then": "the probe returns aggregateVerdict:pass with a zero-drift finding count",
+      "testable": true,
+      "scope": "library",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-4003-edge-cloudflare-tunnel-access-binding",
+        "field": "responsibilities.audAttach"
+      }
     }
   ],
   "tacIds": [
     "TAC-4003-edge-cloudflare-tunnel-access-binding"
   ],
   "createdAt": "2026-09-08T00:00:00.000Z",
-  "updatedAt": "2026-09-08T00:00:00.000Z"
+  "updatedAt": "2026-09-09T13:00:00.000Z"
 }

package/blueprints/edge-cloudflare-tunnel/contributions/user-stories/edge-cloudflare-tunnel-us-39108.json

@@ -13,12 +13,45 @@
       "id": "AC-tunnel-credentialsDiscipline",
       "description": "The fixture credentials placeholder documents the 0o400 host mode and secretRef pattern; the manifest references the credentials via a secretRef; the grep-refuse pattern is documented in the guide; every cloudflaredReady, tunnelConnectorUp and ingressRuleReloaded event body captured by the in-process facade carries metadata only, and SIMULATE_EVENT_SECRECY_LEAK inserts the credentials literal into a lifecycle event body and the scan FAILS naming the leaked field.",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-4002-edge-cloudflare-tunnel-manifest-schema",
+        "field": "responsibilities.credentialsSecretRef"
+      }
+    },
+    {
+      "id": "AC-tunnel-credentialsHostMode",
+      "description": "Given the provisioned host file at the credentialsFile secretRef path, when the credentials-file host mode is inspected, the file exists at mode 0o400 owned by the cloudflared user; a fixture-induced mode of 0o600 or 0o644 refuses the probe with a stable code credentials.host-mode-drift naming the observed mode.",
+      "given": "the provisioned host fixture with the credentials file rendered from the secretRef",
+      "when": "the credentials-discipline probe stats the credentials-file path",
+      "then": "the file at mode 0o400 owned by the cloudflared user passes; induced 0o600/0o644 refuses with credentials.host-mode-drift",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-4002-edge-cloudflare-tunnel-manifest-schema",
+        "field": "responsibilities.credentialsDiscipline"
+      }
+    },
+    {
+      "id": "AC-tunnel-credentialsTrackedTreeScan",
+      "description": "Given the applying-tree git working set, when the grep-refuse scan walks every tracked file for the tunnel-id and account-tag literal substrings, no tracked file matches (the credentials remain out of the tracked tree); a fixture that commits a credentials JSON body refuses the probe with a stable code credentials.tracked-tree-leak naming the offending path.",
+      "given": "the applying-tree git working set with the tunnel id and account tag known from the manifest",
+      "when": "the credentials-discipline probe greps every tracked file for the two literal substrings",
+      "then": "no tracked file matches on the canonical fixture and the fixture-induced committed-credentials variant refuses with credentials.tracked-tree-leak",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-4002-edge-cloudflare-tunnel-manifest-schema",
+        "field": "responsibilities.credentialsDiscipline"
+      }
     }
   ],
   "tacIds": [
     "TAC-4002-edge-cloudflare-tunnel-manifest-schema"
   ],
   "createdAt": "2026-09-08T00:00:00.000Z",
-  "updatedAt": "2026-09-08T00:00:00.000Z"
+  "updatedAt": "2026-09-09T12:00:00.000Z"
 }

package/blueprints/edge-cloudflare-tunnel/contributions/user-stories/edge-cloudflare-tunnel-us-39109.json

@@ -0,0 +1,74 @@
+{
+  "usId": "edge-cloudflare-tunnel-US-39109",
+  "prdId": "PRD-001",
+  "reqId": "edge-cloudflare-tunnel-REQ-006",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Apply resolves the elicited cloudflare-zone-secret via the vault seam and refuses under the documented failure paths; enforces AUD-mandatory when zeroTrustGate is applied",
+  "asA": "shelf consumer applying edge-cloudflare-tunnel with a real Cloudflare zone secret and (optionally) edge-cloudflare-access",
+  "iWant": "apply to resolve the elicited zone secretRef via security-secrets-management, refuse on unresolved and unauthorised paths, and refuse when zeroTrustGate is applied but access-aud is blank",
+  "soThat": "a project that never wires the zone into the vault, or that has no Cloudflare authority on the resolved zone, or that turns on the gate without an AUD, fails at apply rather than at first inbound request",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-tunnel-zoneResolve",
+      "description": "Given the elicited cloudflare-zone-secret is a resolvable security-secrets-management reference, when apply runs, the resolver returns a zone id via the vault seam, no plaintext zone id lands in the applying tree (a grep on the tracked tree for the resolved value finds zero matches), and the applied sidecar carries only the secretRef.",
+      "given": "the fixture apply harness with a resolvable secretRef for cloudflare-zone-secret",
+      "when": "apply runs against the fixture project",
+      "then": "the resolver returns a zone id, the applied sidecar records only the secretRef, and a grep on the tracked tree for the resolved zone id finds zero matches",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-4004-edge-cloudflare-tunnel-zone-and-hostname-apply",
+        "field": "responsibilities.zoneResolve"
+      }
+    },
+    {
+      "id": "AC-tunnel-zoneUnresolved",
+      "description": "Given the elicited cloudflare-zone-secret does not resolve via the vault seam (the reference is missing, or the vault seam returns an error), when apply runs, apply refuses with code apply.zone-unresolved naming the elicit id and no applied sidecar is written.",
+      "given": "the fixture apply harness with an unresolvable secretRef for cloudflare-zone-secret",
+      "when": "apply runs",
+      "then": "apply refuses with code apply.zone-unresolved and no applied sidecar is written",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-4004-edge-cloudflare-tunnel-zone-and-hostname-apply",
+        "field": "responsibilities.zoneResolve"
+      }
+    },
+    {
+      "id": "AC-tunnel-zoneUnauthorised",
+      "description": "Given the injected Cloudflare API returns 401 or 403 on the tunnel-route call for the resolved zone id, when apply runs, apply refuses with code apply.zone-unauthorised naming the resolved zone id metadata (never the token) and no applied sidecar is written.",
+      "given": "the fixture apply harness with an injected Cloudflare API that returns 401/403",
+      "when": "apply runs against the resolved zone",
+      "then": "apply refuses with code apply.zone-unauthorised and no applied sidecar is written",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-4004-edge-cloudflare-tunnel-zone-and-hostname-apply",
+        "field": "responsibilities.zoneResolve"
+      }
+    },
+    {
+      "id": "AC-tunnel-audMandatoryWhenGated",
+      "description": "Given zeroTrustGate is present on the applied capability set and the elicited access-aud is blank, when apply runs, apply refuses with code apply.tunnel-aud-missing naming the elicit id; when access-aud is non-blank apply proceeds and the aud-presence-check probe asserts every ingress rule attaches originRequest.access.aud.",
+      "given": "the fixture apply harness with zeroTrustGate applied and access-aud successively blank and non-blank",
+      "when": "apply runs",
+      "then": "blank access-aud refuses with code apply.tunnel-aud-missing; non-blank access-aud proceeds and every ingress rule attaches originRequest.access.aud",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-4004-edge-cloudflare-tunnel-zone-and-hostname-apply",
+        "field": "responsibilities.audMandatoryWhenGated"
+      }
+    }
+  ],
+  "tacIds": [
+    "TAC-4004-edge-cloudflare-tunnel-zone-and-hostname-apply"
+  ],
+  "createdAt": "2026-09-09T00:00:00.000Z",
+  "updatedAt": "2026-09-09T12:00:00.000Z"
+}

package/blueprints/edge-cloudflare-tunnel/contributions/user-stories/edge-cloudflare-tunnel-us-39110.json

@@ -0,0 +1,60 @@
+{
+  "usId": "edge-cloudflare-tunnel-US-39110",
+  "prdId": "PRD-001",
+  "reqId": "edge-cloudflare-tunnel-REQ-007",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Apply expands the elicited public-hostname template per ingress rule and refuses on malformed templates and duplicate expansions",
+  "asA": "shelf consumer applying edge-cloudflare-tunnel with two or more ingress rules",
+  "iWant": "apply to expand <service>.<zone> per rule and refuse on malformed templates or duplicate expansions",
+  "soThat": "a template that would silently collide two rules on the same hostname is caught at apply rather than at first inbound request",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-tunnel-hostnameTemplateExpand",
+      "description": "Given the default template <service>.<zone> and two ingress rules (service names \"api\" and \"web\") under the resolved zone \"example.com\", when apply runs, the applied sidecar records ingress rules with concrete hostnames \"api.example.com\" and \"web.example.com\"; every rule's hostname field matches ^[a-z0-9-]+(\\.[a-z0-9-]+)+$. Applying agent sets: the applying agent sets the ingress rule service names, the resolved zone (via cloudflare-zone-secret) and, optionally, an override public-hostname-template.",
+      "given": "the fixture apply harness with the default template and two ingress rules",
+      "when": "apply runs and expands the template",
+      "then": "the applied sidecar carries the two concrete hostnames matching the DNS-label regex",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-4004-edge-cloudflare-tunnel-zone-and-hostname-apply",
+        "field": "responsibilities.hostnameTemplateExpand"
+      }
+    },
+    {
+      "id": "AC-tunnel-hostnameTemplateMalformed",
+      "description": "Given a template with an undefined placeholder (e.g. <unknown>), an unclosed brace (e.g. <service.<zone>), or a rendered value that violates DNS label rules (labels longer than 63 chars or characters outside [a-z0-9-]), when apply runs, apply refuses with code apply.hostname-template-malformed naming the offending template and no applied sidecar is written.",
+      "given": "the fixture apply harness with one of the malformed templates",
+      "when": "apply runs and expands the template",
+      "then": "apply refuses with code apply.hostname-template-malformed and no applied sidecar is written",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-4004-edge-cloudflare-tunnel-zone-and-hostname-apply",
+        "field": "responsibilities.hostnameTemplateExpand"
+      }
+    },
+    {
+      "id": "AC-tunnel-hostnameTemplateDuplicate",
+      "description": "Given two ingress rules whose distinct service names expand under the elicited template to the same concrete hostname (for example a template with the <service> placeholder omitted or replaced by a constant), when apply runs, apply refuses with code apply.hostname-template-duplicate naming the collided hostname and both offending rule indices; no applied sidecar is written.",
+      "given": "the fixture apply harness with two ingress rules expanding to the same hostname",
+      "when": "apply runs and computes the expansion table",
+      "then": "apply refuses with code apply.hostname-template-duplicate and no applied sidecar is written",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-4004-edge-cloudflare-tunnel-zone-and-hostname-apply",
+        "field": "responsibilities.hostnameTemplateExpand"
+      }
+    }
+  ],
+  "tacIds": [
+    "TAC-4004-edge-cloudflare-tunnel-zone-and-hostname-apply"
+  ],
+  "createdAt": "2026-09-09T00:00:00.000Z",
+  "updatedAt": "2026-09-09T13:00:00.000Z"
+}

package/blueprints/edge-cloudflare-tunnel/docs/topics.md

@@ -61,7 +61,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 
 US 39101-39108 sit at the LOW end of the 39101-39899 band on purpose (watchpost run-4 lesson). A project-side story mechanically derived from an edge-cloudflare-tunnel REQ id into the number 39108 would collide against the shipped US-39108; band headroom (39109-39899) leaves that space.
 
-Edge-cloudflare-tunnel suffixes for this blueprint use the 4001-4003 block, continuing the widening pattern (deploy-hetzner-server 3801-3804 for the T-1 sibling, platform-docker-compose-host 3901-3904 for the T-2 sibling).
+Edge-cloudflare-tunnel suffixes for this blueprint use the 4001-4003 block, continuing the widening pattern (deploy-hetzner-server 3801-3804 for the host sibling, platform-docker-compose-host 3901-3904 for the compose-host sibling).
 
 ## Cross-references