rcf-lite 0.26.0 → 0.28.0

package/blueprints/deploy-hetzner-server/guide/deploy-hetzner-server.md

@@ -29,14 +29,14 @@ is the canonical example. Copy it and edit:
 
 ```jsonc
 {
-  "name": "ops-01",
+  "name": "ops-host",
   "serverType": "cx33",
   "location": "fsn1",
   "image": "ubuntu-24.04",
-  "sshKeyIds": ["dave-ed25519", "baz-yubikey"],
+  "sshKeyIds": ["primary-admin-ed25519", "backup-admin-yubikey"],
   "networkId": null,
   "firewallId": null,
-  "cloudInitPath": "hetzner/servers/rendered/ops-01.cloud-init.yaml",
+  "cloudInitPath": "hetzner/servers/rendered/ops-host.cloud-init.yaml",
   "labels": {
     "role": "ops-host",
     "blueprint": "deploy-hetzner-server"
@@ -106,7 +106,7 @@ elicit change.
 ## When to reach for `cx23` vs `cx33`
 
 - `cx23` (default). Two vCPU, 4 GB RAM, 40 GB SSD. Approximately
-  EUR 4.15/month. Fine for the docker-compose stack that ops-01
+  EUR 4.15/month. Fine for the docker-compose stack that ops-host
   runs (fewer than ten containers, each below 300 MB RSS).
 - `cx33`. Two vCPU, 8 GB RAM, 80 GB SSD. Approximately EUR
   7.99/month. Reach when the compose stack holds a Postgres, a
@@ -143,7 +143,7 @@ https://docs.hetzner.com/cloud/servers/backups-snapshots/overview.
 Fire a snapshot manually from the applying project's CLI:
 
 ```
-node ./scripts/snapshot.mjs --server ops-01
+node ./scripts/snapshot.mjs --server ops-host
 ```
 
 The script imports the provisioner facade, calls `takeSnapshot`,
@@ -159,15 +159,16 @@ ceiling: EUR 0.006/hour per run; destroy runs in `always()`; nightly
 `sweep-orphans` cron collects any leak on a 60-minute label-age
 cutoff.
 
-Round-7 T-2 (`platform-docker-compose-host`) and T-3
-(`edge-cloudflare-tunnel`) EXTEND this fixture rather than shipping
-a second copy. T-2 mounts the docker + compose verbs on the same
-throwaway server after cloud-init seals the baseline; T-3 mounts
-`cloudflared` on the runtime T-2 stands up.
+Round-7 `platform-docker-compose-host` and
+`edge-cloudflare-tunnel` EXTEND this fixture rather than shipping
+a second copy. The container-host blueprint mounts the docker + compose
+verbs on the same throwaway server after cloud-init seals the baseline;
+the edge-tunnel blueprint mounts `cloudflared` on the runtime the
+container-host stack stands up.
 
 ## Standards trace
 
-Every URL fetched 200 in the ratifying pass before the T-1 PR.
+Every URL fetched 200 in the ratifying pass before the PR.
 
 - Hetzner Cloud API https://docs.hetzner.cloud/
 - Hetzner Cloud CLI https://github.com/hetznercloud/cli

package/blueprints/edge-cloudflare-access/CHANGELOG.md

@@ -1,6 +1,39 @@
 # Changelog
 
+## 1.1.4 - 2026-09-12
+
+- The application-admin-console fixture now refuses unauthenticated requests on gated sign-in paths (AC-21815-2), so the admin-console-gate-surface probe supplies a fixture Authorization header when the applied capability set includes zeroTrustGate; the fallback (non-gated) request is unchanged.
+
+## 1.1.3 - 2026-09-10
+
+Positive-evidence rule alignment on the probe pack skip path (authoring standard section 7d); register tidy in shipped prose (no capability change).
+
+- Probes and fixture: the account-bound skip return on `contributions/probes/real-account-gated-url.mjs` now carries a `reason` field naming the exact env var(s) that were unset; the same fixture README (`packages/rcf-lite/test/fixtures/cf-edge/README.md`) gains a "Declared env vars" section covering the access-side env-var surface, per authoring standard section 7d. Skip-path probe reports regenerated so the shipped shape carries the new field.
+
+## 1.1.2 - 2026-09-10
+
+Single-mechanism story legality notes; owner reference for the audit-record shape.
+
+- Appended the section 7a legality note to AC-34101-1, AC-34105-1, AC-34106-1, AC-34108-1, AC-34109-1 and AC-34110-1 recording that each single-AC story's mechanism has no additional documented failure path in the guide or the anchored TAC (adjacent failure paths are owned by sibling stories, not by these).
+- Rewrote REQ-004 description to reference the owning TAC field (`TAC-3501-edge-cloudflare-access-jwt-validator.responsibilities[2]`) for the audit-record shape, rather than restating the shape verbatim.
+
+## 1.1.1 (register-sweep patch, 2026-09-10)
+
+- Register: neutral wording in shipped prose (no capability change).
+
+## 1.1.0 - 2026-09-09
+
+Adds REQ-007 with its US-34110 binding, and adds failure-path ACs to US-34102, US-34104 and US-34107.
+- Added REQ-007 and US-34110: the shipped guide names, per policy-shape option, the required dashboard-owned inputs (email domain, group name, identity provider, application-vs-path scope) and every shipped elicit alongside its runtime effect (closes F-1).
+- Added failure-path ACs to US-34102 (AC-34102-2..5 close F-2: wrong audience, malformed JWT, unknown kid after refresh, JWKS-unavailable fail-closed); US-34104 (AC-34104-2..3 close F-3: neither and both application identifiers refuse apply); US-34107 (AC-34107-2..5 close F-4: break-glass disabled, wrong id, wrong secret via constant-time compare, and partial-pair fall-through).
+- Every REQ now carries `deliveredBy`; every AC carries `disposition`; ACs referencing owner-owned literals carry `ownerRef`.
+- De-identified in-house references in US-34109.
+- Chain-consistency lint reports 0 findings on both passes.
+
+
 All notable changes to `edge-cloudflare-access` are recorded here. The shape follows Keep a Changelog and Semantic Versioning per the blueprint authoring standard.
+- split US-34103 into canonical-pass and SIMULATE_NON_VALIDATOR_HEADER-fail ACs, each with a concrete oracle (probe verdict + named field) and an `ownerRef` into TAC-3501. Re-marked ACs per section 7b: mechanism-invariant refusal reasons (`aud-mismatch`, `jwt-malformed`, `kid-unknown`, `jwks-unavailable`, `bypass-id-mismatch`, `bypass-secret-mismatch`, `jwt-missing`), audit-record shapes, guide-section presence assertions and the JWT validator happy path stay `fixed`; US-34104 AC-34104-1 (elicit shape recording), US-34107 AC-34107-1/-3/-4/-5 (bypass id/secret pair) and US-34109 AC-34109-1 (CF_ACCESS_HOST) re-marked `template` naming the values the applying agent sets (access-application-host or access-selfhosted-app-id, access-audience, access-jwks-url, access-policy-shape enum, access-bypass-service-auth-id + paired secret, CF_ACCESS_HOST). Vendor citations added on US-34101 (Cf-Access-Jwt-Assertion header), US-34105 (Zero Trust dashboard docs), US-34107 AC-34107-1 (service-tokens docs) and US-34109 (Access policies docs). Genuinely single-mechanism stories (US-34101, US-34105, US-34106, US-34108, US-34109, US-34110) carry the section-7a note inside the story `description` field, not in a schema-illegal new field.
+
 
 ## 1.0.0 (2026-09-07)
 
@@ -11,13 +44,13 @@ All notable changes to `edge-cloudflare-access` are recorded here. The shape fol
 - 6 Node-only probes under `contributions/probes/`: `jwt-validator-fixture` (fixture-signed JWT validates and principal reduces to `{email, sub, groups}` on request.auth), `jwt-validator-reject` (three subcases: missing header, expired exp, mis-signed each return 401 with one metadata-only audit event), `admin-console-gate-surface` (extended admin-console fixture flips its sign-in surface per applied capability set; covers `AC-34108-1`), `audit-event-secrecy` (5 pass + 5 reject runs produce 10 metadata-only records with no forbidden substrings, no token slices, no header names beyond `path`), `real-account-gated-url` (`accountBound: true`; records `accountBoundSkipped: true` in CI without `CI_HAS_CLOUDFLARE_ACCOUNT` per spec section 3.5) and `wrangler-seam` (drives `wrangler dev --local` on the fixture; `/protected` returns HTTP 401 on the shipped validator's missing-header reject path; `/health` returns HTTP 200 exempt; warn semantics per section 3.1 pass-with-skip if wrangler is missing or fails to bind).
 - 6 elicited parameters on `blueprint.json`: `access-application-host` (or `access-selfhosted-app-id`, exactly one required), `access-audience`, `access-jwks-url`, `access-policy-shape` (enum default `email-domain`), `access-bypass-service-auth-id` (blank disables break-glass).
 - `suggestedCompanions`: `logging` (for the metadata-only audit sink retention), `errorHandling` (for the validator failure boundary) and `secretsManagement` (for the paired break-glass service-auth secret).
-- Ships the shared `cf-edge` sample-app fixture at `packages/rcf-lite/test/fixtures/cf-edge/` (T-4 mints it per spec section 3.3). The fixture ships the applied Worker (`src/index.mjs`), the JWT validator (`src/jwt-validator.mjs`, sole reader of the `Cf-Access-Jwt-Assertion` header), a dependency-free RS256 fixture-JWT signer (`test/jwt-signer.mjs`) and a local JWKS server (`test/jwks-server.mjs`). No new rcf-lite runtime dependency (Node's built-in `crypto` module signs and verifies).
+- Ships the shared `cf-edge` sample-app fixture at `packages/rcf-lite/test/fixtures/cf-edge/` (mints it per spec section 3.3). The fixture ships the applied Worker (`src/index.mjs`), the JWT validator (`src/jwt-validator.mjs`, sole reader of the `Cf-Access-Jwt-Assertion` header), a dependency-free RS256 fixture-JWT signer (`test/jwt-signer.mjs`) and a local JWKS server (`test/jwks-server.mjs`). No new rcf-lite runtime dependency (Node's built-in `crypto` module signs and verifies).
 - Extends `packages/rcf-lite/test/fixtures/probe-pack-application-admin-console/` with a `/admin/sign-in` route rendering the Access-gated surface (with `?caps=zeroTrustGate`) or the local-login surface (without). The extension rides `application-admin-console` v1.1.0.
-- Anatomy test at `packages/rcf-lite/test/blueprint/edge-cloudflare-access-anatomy.test.js` covers `TS-110..119` on the T-4 chain slice (blueprint shape, contributions cross-check, JWT validator behaviour, sole-reader guarantee, audit-event secrecy, break-glass posture, admin-console composition, fixture files, ADR bodies and clauses, guide sections and vendor URL).
+- Anatomy test at `packages/rcf-lite/test/blueprint/edge-cloudflare-access-anatomy.test.js` covers `TS-110..119` on the chain slice (blueprint shape, contributions cross-check, JWT validator behaviour, sole-reader guarantee, audit-event secrecy, break-glass posture, admin-console composition, fixture files, ADR bodies and clauses, guide sections and vendor URL).
 
 ### Known limitations
 
 - The `real-account-gated-url` probe records `accountBoundSkipped: true` and aggregates to `pass` when `CI_HAS_CLOUDFLARE_ACCOUNT` or `CF_ACCESS_HOST` are unset (spec section 3.5 pass-with-skip). Full mechanism reach requires a CI environment with both env vars set and a deployed hostname behind an issued Zero Trust policy.
 - The v1.0.0 boundary defers per-path policy scope authoring, group-membership rule authoring and identity-provider federation to v1.1.0. The shipped validator observes the JWT's `groups` claim but does not enforce policy on it (the Cloudflare edge enforces before the request reaches the origin Worker); a future minor could ship a group-membership refinement.
-- The `wrangler-seam` probe warns (never fails) when `wrangler` is not installed under `packages/rcf-lite/test/fixtures/cf-edge/node_modules/.bin/wrangler`; a handler thrown at the workerd boundary is a genuine fail per the round-6 T-3 gate directive.
+- The `wrangler-seam` probe warns (never fails) when `wrangler` is not installed under `packages/rcf-lite/test/fixtures/cf-edge/node_modules/.bin/wrangler`; a handler thrown at the workerd boundary is a genuine fail per the round-6 gate directive.
 - The Access-gated sign-in surface on `application-admin-console` v1.1.0 shows a placeholder principal email in the fixture (supplied via `?principalEmail=` or `ADMIN_CONSOLE_PRINCIPAL_EMAIL` env var). In a real deployment the principal reads from `request.auth.email` the JWT validator attaches; the fixture does not embed the validator (it renders the surface).

package/blueprints/edge-cloudflare-access/README.md

@@ -22,7 +22,7 @@ value beyond `path` ever leaves the validator boundary.
   vendor-neutral seam (`request.auth`) between the edge and the
   downstream handler.
 - Compose with `application-admin-console` v1.1.0 for the Access-gated
-  sign-in surface (round-4 T-4 capability-minor pattern).
+  sign-in surface.
 
 ## The six REQs
 
@@ -138,4 +138,4 @@ Each probe prints a report envelope and writes it to
   optionally: the admin-console's sign-in surface renders
   Access-gated when `zeroTrustGate` is in the applied set (and
   falls back to `security-auth-*` local login otherwise). The
-  v1.1.0 minor rides this PR (round-4 T-4 capability-minor pattern).
+  v1.1.0 minor rides this PR.

package/blueprints/edge-cloudflare-access/blueprint.json

@@ -1,6 +1,6 @@
 {
   "slug": "edge-cloudflare-access",
-  "version": "1.0.0",
+  "version": "1.1.4",
   "category": "edge",
   "capabilities": [
     "zeroTrustGate"
@@ -192,6 +192,16 @@
       "recommendedDefault": true,
       "elicited": false,
       "standardsTraceClause": "generic enterprise practice"
+    },
+    {
+      "id": "edge-cloudflare-access-REQ-007",
+      "kind": "req",
+      "path": "requirements/edge-cloudflare-access-req-007.json"
+    },
+    {
+      "id": "edge-cloudflare-access-US-34110",
+      "kind": "us",
+      "path": "user-stories/edge-cloudflare-access-us-34110.json"
     }
   ]
-}
+}

package/blueprints/edge-cloudflare-access/contributions/probes/admin-console-gate-surface.mjs

@@ -46,7 +46,15 @@ async function bootServer() {
 
 async function fetchDom(url, caps) {
   const target = `${url}/admin/sign-in?caps=${encodeURIComponent(caps)}`;
-  const res = await fetch(target);
+  // The admin-console fixture refuses unauthenticated gated requests
+  // with HTTP 403 (AC-21815-2), so the probe supplies a fixture
+  // Authorization header when the capability set includes
+  // zeroTrustGate so the gated surface can be observed.
+  const capsList = caps.split(',').map((s) => s.trim());
+  const headers = capsList.includes('zeroTrustGate')
+    ? { Authorization: 'Principal probe-signin@example.test' }
+    : undefined;
+  const res = await fetch(target, headers ? { headers } : undefined);
   return { status: res.status, body: await res.text(), target };
 }
 

package/blueprints/edge-cloudflare-access/contributions/probes/real-account-gated-url.mjs

@@ -29,14 +29,22 @@ export default async function runProbe() {
   const has = process.env.CI_HAS_CLOUDFLARE_ACCOUNT === 'true';
   const host = process.env.CF_ACCESS_HOST || '';
   if (!has || !host) {
+    // Positive-evidence rule (authoring standard section 7d): the skip
+    // record names the exact env var(s) that were unset in `reason`,
+    // so a `pass` verdict is legal without positive evidence.
+    const unset = [];
+    if (!has) unset.push('CI_HAS_CLOUDFLARE_ACCOUNT');
+    if (!host) unset.push('CF_ACCESS_HOST');
+    const reason = unset.join(', ');
     return {
       results: [{
         anchorAcId: 'AC-34109-1',
         verdict: 'pass',
         accountBoundSkipped: true,
-        detail: `accountBoundSkipped: CI_HAS_CLOUDFLARE_ACCOUNT=${has} CF_ACCESS_HOST=${host ? 'set' : 'unset'}; per spec section 3.5 pass-with-skip.`,
+        reason,
+        detail: `accountBoundSkipped: ${reason} unset; per spec section 3.5 pass-with-skip.`,
       }],
-      extra: { accountBoundSkipped: true },
+      extra: { accountBoundSkipped: true, reason },
     };
   }
   try {

package/blueprints/edge-cloudflare-access/contributions/probes/wrangler-seam.mjs

@@ -18,7 +18,7 @@
 // Warn semantics per spec section 3.1 pass-with-skip:
 //   - wrangler devDependency missing: aggregateVerdict warn (never fail);
 //   - wrangler CLI fails to bind within the cap: warn.
-//   - A handler thrown at the workerd boundary: fail (per round-6 T-3 gate).
+//   - A handler thrown at the workerd boundary: fail (per round-6 gate).
 //
 // Mutation-check pair for the negative fires: removing the
 // validator's early-return call on missing header would surface

package/blueprints/edge-cloudflare-access/contributions/requirements/edge-cloudflare-access-req-001.json

@@ -13,5 +13,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-07T16:00:00.000Z",
-  "updatedAt": "2026-09-07T16:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00.000Z",
+  "deliveredBy": {
+    "tacId": "TAC-3501-edge-cloudflare-access-jwt-validator",
+    "field": "interfaces.createAccessValidator"
+  }
 }

package/blueprints/edge-cloudflare-access/contributions/requirements/edge-cloudflare-access-req-002.json

@@ -13,5 +13,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-07T16:00:00.000Z",
-  "updatedAt": "2026-09-07T16:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00.000Z",
+  "deliveredBy": {
+    "tacId": "TAC-3502-edge-cloudflare-access-application-declaration",
+    "field": "responsibilities.applicationDeclaration"
+  }
 }

package/blueprints/edge-cloudflare-access/contributions/requirements/edge-cloudflare-access-req-003.json

@@ -13,5 +13,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-07T16:00:00.000Z",
-  "updatedAt": "2026-09-07T16:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00.000Z",
+  "deliveredBy": {
+    "tacId": "TAC-3503-edge-cloudflare-access-policy-shape",
+    "field": "responsibilities.policyIssueGuide"
+  }
 }

package/blueprints/edge-cloudflare-access/contributions/requirements/edge-cloudflare-access-req-004.json

@@ -2,7 +2,7 @@
   "reqId": "edge-cloudflare-access-REQ-004",
   "prdId": "PRD-001",
   "title": "The audit event carries only metadata fields (email, outcome, timestamp, path) with no token value and no header names beyond path",
-  "description": "Every validate-pass, validate-reject and bypass emits exactly one audit event on the injected sink with the metadata-only shape {email, outcome, timestamp, path}. The record is Object.frozen at the validator boundary so no downstream module can enrich it with a stray token slice or header value. The serialised JSON of every record contains no substring of the JWT (header, payload or signature), no Authorization value, and no header names beyond path.",
+  "description": "Every validate-pass, validate-reject and bypass emits exactly one audit event on the injected sink with the metadata-only record shape named on `TAC-3501-edge-cloudflare-access-jwt-validator.responsibilities[2]`. The record is Object.frozen at the validator boundary so no downstream module can enrich it with a stray token slice or header value. The serialised JSON of every record contains no substring of the JWT (header, payload or signature), no Authorization value, and no header names beyond the field the TAC owner names.",
   "category": "functional",
   "domain": "edge",
   "priority": "must",
@@ -13,5 +13,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-07T16:00:00.000Z",
-  "updatedAt": "2026-09-07T16:00:00.000Z"
+  "updatedAt": "2026-09-10T00:00:00.000Z",
+  "deliveredBy": {
+    "tacId": "TAC-3504-edge-cloudflare-access-audit-sink",
+    "field": "responsibilities.metadataOnlyRecord"
+  }
 }

package/blueprints/edge-cloudflare-access/contributions/requirements/edge-cloudflare-access-req-005.json

@@ -13,5 +13,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-07T16:00:00.000Z",
-  "updatedAt": "2026-09-07T16:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00.000Z",
+  "deliveredBy": {
+    "tacId": "TAC-3501-edge-cloudflare-access-jwt-validator",
+    "field": "responsibilities.breakGlassPath"
+  }
 }

package/blueprints/edge-cloudflare-access/contributions/requirements/edge-cloudflare-access-req-006.json

@@ -2,11 +2,11 @@
   "reqId": "edge-cloudflare-access-REQ-006",
   "prdId": "PRD-001",
   "title": "Composition with application-admin-console v1.1.0: the sign-in surface flips per applied capability set",
-  "description": "When application-admin-console v1.1.0 is applied alongside edge-cloudflare-access, the admin-console reads the appliedCapabilities set at apply-time (via the shipped readAppliedCapabilities helper, the T-5 visual-round mechanism); with zeroTrustGate in the set the admin-console renders the Access-gated sign-in surface (data-surface=access-gated, no [data-surface=local-login], a [data-role=principal-read] with the request.auth email); without zeroTrustGate the admin-console falls back to whatever security-auth-* is applied (data-surface=local-login). The composition is deterministic; the pack check AC-21815-1 on the shipped application-admin-console.pack.mjs enforces the gated branch.",
+  "description": "When application-admin-console v1.1.0 is applied alongside edge-cloudflare-access, the admin-console reads the appliedCapabilities set at apply-time (via the shipped readAppliedCapabilities helper); with zeroTrustGate in the set the admin-console renders the Access-gated sign-in surface (data-surface=access-gated, no [data-surface=local-login], a [data-role=principal-read] with the request.auth email); without zeroTrustGate the admin-console falls back to whatever security-auth-* is applied (data-surface=local-login). The composition is deterministic; the pack check AC-21815-1 on the shipped application-admin-console.pack.mjs enforces the gated branch.",
   "category": "functional",
   "domain": "edge",
   "priority": "must",
-  "rationale": "Ratified in the Cloudflare round 6 spec (2026-09-06 section 5.4 plus section 5.4.1 admin-console v1.1.0 delta; spec section 1 ruling 7). Ships as v1.0.0 of edge-cloudflare-access and v1.1.0 of application-admin-console in the same PR (round-4 T-4 capability-minor pattern).",
+  "rationale": "Ratified in the Cloudflare round 6 spec (2026-09-06 section 5.4 plus section 5.4.1 admin-console v1.1.0 delta; spec section 1 ruling 7). Ships as v1.0.0 of edge-cloudflare-access and v1.1.0 of application-admin-console in the same PR (round-4 capability-minor pattern).",
   "tags": [
     "blueprint:edge-cloudflare-access",
     "blueprint:application-admin-console"
@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-07T16:00:00.000Z",
-  "updatedAt": "2026-09-07T16:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00.000Z",
+  "deliveredBy": {
+    "adrId": "ADR-3503-edge-cloudflare-access-policy-scope",
+    "field": "decision.capabilityFlip"
+  }
 }

package/blueprints/edge-cloudflare-access/contributions/requirements/edge-cloudflare-access-req-007.json

@@ -0,0 +1,22 @@
+{
+  "reqId": "edge-cloudflare-access-REQ-007",
+  "prdId": "PRD-001",
+  "title": "Policy-shape inputs (email-domain, group-membership, identity-provider, service-token) are dashboard-owned; the shipped guide names every input and every elicit",
+  "description": "The policy-shape enum (email-domain, service-token-only, service-token-plus-email-domain, group-membership) governs which Cloudflare Access policy the operator issues on the dashboard side. The blueprint owns the JWT validator side and does NOT elicit the four dashboard-owned inputs (email domain, group name, identity provider, application/path scope); those inputs live on the Cloudflare Zero Trust dashboard and are named in the shipped guide walk-through. The shipped guide MUST name each of the four dashboard-owned inputs per policy-shape option and MUST name each shipped elicit (access-application-host, access-selfhosted-app-id, access-audience, access-jwks-url, access-policy-shape, access-bypass-service-auth-id) alongside its runtime effect; the applying agent traces every policy the operator issues to the guide entry that names the required input.",
+  "category": "functional",
+  "domain": "edge",
+  "priority": "must",
+  "rationale": "Closes review P1 F-1 (policy-shape options with under-specified inputs). The Cloudflare dashboard is the owner of the identity/group/domain/path inputs (they live in the Access application, not in the JWT validator); the blueprint's job is to document each input in the guide and to elicit only the JWT-side values the validator consumes.",
+  "tags": [
+    "blueprint:edge-cloudflare-access",
+    "capability:zeroTrustGate"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-09T00:00:00.000Z",
+  "updatedAt": "2026-09-09T00:00:00.000Z",
+  "deliveredBy": {
+    "tacId": "TAC-3503-edge-cloudflare-access-policy-shape",
+    "field": "responsibilities.dashboard"
+  }
+}

package/blueprints/edge-cloudflare-access/contributions/user-stories/edge-cloudflare-access-us-34101.json

@@ -11,17 +11,27 @@
   "acceptanceCriteria": [
     {
       "id": "AC-34101-1",
-      "description": "The JWT validator reads Cf-Access-Jwt-Assertion, verifies against the fixture JWKS (RS256, kid rotation supported by the per-kid cache), reduces the principal into request.auth as {email, sub, groups} and the downstream handler receives a 200 with the reduced principal fields exposed on request.auth.",
+      "description": "The JWT validator reads Cf-Access-Jwt-Assertion, verifies against the fixture JWKS (RS256, kid rotation supported by the per-kid cache), reduces the principal into request.auth as {email, sub, groups} and the downstream handler receives a 200 with the reduced principal fields exposed on request.auth. Per section 7a, this AC is legal as the single AC on the story because the guide and the anchored TAC name no additional documented failure path for this mechanism (adjacent failure paths are owned by sibling stories on the same blueprint, not by this one).",
       "given": "a Worker fetch handler wired with createAccessValidator(...).middleware and a fixture-signed JWT presented in the Cf-Access-Jwt-Assertion header",
       "when": "the request dispatches through the validator",
       "then": "the validator resolves, attaches {email, sub, groups} onto request.auth and delegates to the handler which returns 200 with the reduced principal reflected on the response body",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3501-edge-cloudflare-access-jwt-validator",
+        "field": "interfaces.createAccessValidator"
+      },
+      "vendorCitation": {
+        "url": "https://developers.cloudflare.com/cloudflare-one/policies/access/",
+        "verifiedOn": "2026-09-09"
+      }
     }
   ],
   "tacIds": [
     "TAC-3501-edge-cloudflare-access-jwt-validator"
   ],
   "createdAt": "2026-09-07T16:00:00.000Z",
-  "updatedAt": "2026-09-07T16:00:00.000Z"
+  "updatedAt": "2026-09-10T00:00:00.000Z",
+  "description": "Story owns the JWT validator happy path (Cf-Access-Jwt-Assertion accepted, principal reduced onto request.auth). Reject branches (missing header, expired exp, mis-signed, aud-mismatch, jwt-malformed, kid-unknown, jwks-unavailable) live on US-34102 and break-glass branches on US-34107; per section 7a, this story carries a single AC because its own mechanism has no additional documented failure path in the guide or the anchored TAC."
 }

package/blueprints/edge-cloudflare-access/contributions/user-stories/edge-cloudflare-access-us-34102.json

@@ -16,7 +16,68 @@
       "when": "the request dispatches through the validator",
       "then": "the validator returns 401 and emits one audit event whose outcome is drawn from {missing, expired, invalid} with the allowed-key shape",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3501-edge-cloudflare-access-jwt-validator",
+        "field": "interfaces.createAccessValidator"
+      }
+    },
+    {
+      "id": "AC-34102-2",
+      "description": "Given a well-formed JWT whose aud claim does not match the elicited access-audience, when the validator checks the token, the request is refused with HTTP 401, no downstream handler runs, and exactly one metadata-only audit event with outcome:\"reject\" reason:\"aud-mismatch\" fires; the audit record carries no token substring.",
+      "given": "the fixture applied source with the validator wired and the elicited access-audience configured",
+      "when": "a request presents a well-formed JWT whose aud claim does not match the elicited access-audience",
+      "then": "the validator returns 401 with reason \"aud-mismatch\" and emits one metadata-only audit event",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3501-edge-cloudflare-access-jwt-validator",
+        "field": "interfaces.createAccessValidator"
+      }
+    },
+    {
+      "id": "AC-34102-3",
+      "description": "Given a malformed JWT (three-segment shape violated, base64url decode fails, or JSON parse fails on any segment), when the validator inspects the token, the request is refused with HTTP 401 outcome:\"reject\" reason:\"jwt-malformed\" and one metadata-only audit event fires; no downstream handler runs.",
+      "given": "the fixture applied source with the validator wired",
+      "when": "a request presents a malformed Cf-Access-Jwt-Assertion (not three dot-separated segments, or base64url/JSON parse fails)",
+      "then": "the validator returns 401 reason \"jwt-malformed\" and emits one metadata-only audit event; no downstream handler runs",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3501-edge-cloudflare-access-jwt-validator",
+        "field": "interfaces.createAccessValidator"
+      }
+    },
+    {
+      "id": "AC-34102-4",
+      "description": "Given a JWT whose kid header does not resolve to any key in the current JWKS after a single forced refresh, when the validator attempts signature verification, the request is refused with HTTP 401 outcome:\"reject\" reason:\"kid-unknown\" and one metadata-only audit event fires; no downstream handler runs and no more than one JWKS refresh fires per request.",
+      "given": "the fixture applied source with the validator wired and a JWKS whose current keys do not include the token kid",
+      "when": "a request presents a JWT whose kid header is absent from JWKS both before and after a forced refresh",
+      "then": "the validator returns 401 reason \"kid-unknown\", emits one metadata-only audit event, and no more than one JWKS refresh fires per request",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3501-edge-cloudflare-access-jwt-validator",
+        "field": "interfaces.createAccessValidator"
+      }
+    },
+    {
+      "id": "AC-34102-5",
+      "description": "Given the JWKS endpoint returns a non-2xx or a network error on both the initial fetch and the forced refresh, when the validator attempts verification, the request is refused with HTTP 503 outcome:\"reject\" reason:\"jwks-unavailable\" fail-closed and one metadata-only audit event fires; no downstream handler runs; the response carries no upstream body echo.",
+      "given": "the fixture applied source with the validator wired and an injected fetch that fails the JWKS endpoint on both attempts",
+      "when": "a request presents a well-formed JWT and the validator attempts to load the JWKS",
+      "then": "the validator returns 503 reason \"jwks-unavailable\" (fail-closed) and emits one metadata-only audit event",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3501-edge-cloudflare-access-jwt-validator",
+        "field": "interfaces.createAccessValidator"
+      }
     }
   ],
   "tacIds": [
@@ -24,5 +85,5 @@
     "TAC-3504-edge-cloudflare-access-audit-sink"
   ],
   "createdAt": "2026-09-07T16:00:00.000Z",
-  "updatedAt": "2026-09-07T16:00:00.000Z"
+  "updatedAt": "2026-09-09T12:00:00.000Z"
 }

package/blueprints/edge-cloudflare-access/contributions/user-stories/edge-cloudflare-access-us-34103.json

@@ -11,17 +11,32 @@
   "acceptanceCriteria": [
     {
       "id": "AC-34103-1",
-      "description": "The sole-reader scan walks the fixture applied source root (src/**/*.mjs), strips comments and string literals, and finds exactly one live-source occurrence of the header string Cf-Access-Jwt-Assertion, in src/jwt-validator.mjs. Any other live-source occurrence in a shipped module fails the probe (SIMULATE_NON_VALIDATOR_HEADER=true injects a second hit and the probe fails).",
+      "description": "Given the canonical fixture applied source root (src/**/*.mjs), when the sole-reader scan walks the tree, strips comments and string literals, and searches for live-source occurrences of the header string Cf-Access-Jwt-Assertion, the scan finds exactly one live-source occurrence in src/jwt-validator.mjs and the probe returns aggregateVerdict:pass.",
       "given": "the cf-edge fixture applied source tree",
       "when": "the sole-reader-scan probe walks src/**/*.mjs",
       "then": "the only live-source hit for Cf-Access-Jwt-Assertion is in src/jwt-validator.mjs",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-34103-2",
+      "description": "Given the SIMULATE_NON_VALIDATOR_HEADER=true switch (a second live-source occurrence of Cf-Access-Jwt-Assertion is injected outside src/jwt-validator.mjs), when the sole-reader scan runs on the fixture applied source root, the probe returns aggregateVerdict:fail with detail naming the offending file path.",
+      "given": "the fixture applied source root with SIMULATE_NON_VALIDATOR_HEADER=true (a second live-source hit on Cf-Access-Jwt-Assertion injected outside src/jwt-validator.mjs)",
+      "when": "the sole-reader scan runs",
+      "then": "the probe returns aggregateVerdict:fail with detail naming the offending file path",
+      "testable": true,
+      "scope": "library",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3501-edge-cloudflare-access-jwt-validator",
+        "field": "responsibilities.headerSoleReader"
+      }
     }
   ],
   "tacIds": [
     "TAC-3501-edge-cloudflare-access-jwt-validator"
   ],
   "createdAt": "2026-09-07T16:00:00.000Z",
-  "updatedAt": "2026-09-07T16:00:00.000Z"
+  "updatedAt": "2026-09-09T13:00:00.000Z"
 }

package/blueprints/edge-cloudflare-access/contributions/user-stories/edge-cloudflare-access-us-34104.json

@@ -11,17 +11,50 @@
   "acceptanceCriteria": [
     {
       "id": "AC-34104-1",
-      "description": "blueprint.json elicits access-application-host (kind string) and access-selfhosted-app-id (kind string; the operator supplies exactly one), plus access-audience (kind string), access-jwks-url (kind string), access-policy-shape (kind enum with options email-domain, service-token-only, service-token-plus-email-domain, group-membership; recommended default email-domain) and access-bypass-service-auth-id (kind string; blank disables break-glass). Applying the blueprint records the elicited values on rcf/blueprints/edge-cloudflare-access.applied.json.",
+      "description": "blueprint.json elicits access-application-host (kind string) and access-selfhosted-app-id (kind string; the operator supplies exactly one), plus access-audience (kind string), access-jwks-url (kind string), access-policy-shape (kind enum with options email-domain, service-token-only, service-token-plus-email-domain, group-membership; recommended default email-domain) and access-bypass-service-auth-id (kind string; blank disables break-glass). Applying the blueprint records the elicited values on rcf/blueprints/edge-cloudflare-access.applied.json. Applying agent sets: the applying agent picks exactly one of access-application-host or access-selfhosted-app-id, sets access-audience, access-jwks-url, one of the four access-policy-shape enum values, and (optionally) an access-bypass-service-auth-id.",
       "given": "the blueprint.json elicits block",
       "when": "the apply verb runs against a fixture project",
       "then": "rcf/blueprints/edge-cloudflare-access.applied.json carries the elicited values plus appliedCapabilities=[zeroTrustGate]",
       "testable": true,
-      "scope": "library"
+      "scope": "library",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-3502-edge-cloudflare-access-application-declaration",
+        "field": "interfaces.applicationDeclaration"
+      }
+    },
+    {
+      "id": "AC-34104-2",
+      "description": "Given neither access-application-host nor access-selfhosted-app-id is supplied at apply time, when the applying agent runs apply, the apply verb refuses with a stable validation code apply.application-declaration-missing naming both elicit ids and writes no sidecar.",
+      "given": "blueprint.json elicits access-application-host and access-selfhosted-app-id, both empty at apply time",
+      "when": "the applying agent runs apply",
+      "then": "apply refuses with code apply.application-declaration-missing and rcf/blueprints/edge-cloudflare-access.applied.json is not written",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3502-edge-cloudflare-access-application-declaration",
+        "field": "responsibilities.applicationDeclaration"
+      }
+    },
+    {
+      "id": "AC-34104-3",
+      "description": "Given both access-application-host AND access-selfhosted-app-id are supplied at apply time, when the applying agent runs apply, the apply verb refuses with a stable validation code apply.application-declaration-ambiguous naming both elicit ids and writes no sidecar.",
+      "given": "blueprint.json elicits access-application-host and access-selfhosted-app-id, both non-empty at apply time",
+      "when": "the applying agent runs apply",
+      "then": "apply refuses with code apply.application-declaration-ambiguous and rcf/blueprints/edge-cloudflare-access.applied.json is not written",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3502-edge-cloudflare-access-application-declaration",
+        "field": "responsibilities.applicationDeclaration"
+      }
     }
   ],
   "tacIds": [
     "TAC-3502-edge-cloudflare-access-application-declaration"
   ],
   "createdAt": "2026-09-07T16:00:00.000Z",
-  "updatedAt": "2026-09-07T16:00:00.000Z"
+  "updatedAt": "2026-09-09T13:00:00.000Z"
 }

package/blueprints/edge-cloudflare-access/contributions/user-stories/edge-cloudflare-access-us-34105.json

@@ -11,17 +11,27 @@
   "acceptanceCriteria": [
     {
       "id": "AC-34105-1",
-      "description": "The shipped guide/edge-cloudflare-access.md carries a section Zero Trust dashboard walk-through with numbered steps naming each screen; and a section API alternative with a curl example against https://api.cloudflare.com/client/v4/accounts/{account_id}/access/apps/{app_id}/policies; the vendor URL https://developers.cloudflare.com/cloudflare-one/policies/access/ is cited from ADR-3501 and the guide.",
+      "description": "The shipped guide/edge-cloudflare-access.md carries a section Zero Trust dashboard walk-through with numbered steps naming each screen; and a section API alternative with a curl example against https://api.cloudflare.com/client/v4/accounts/{account_id}/access/apps/{app_id}/policies; the vendor URL https://developers.cloudflare.com/cloudflare-one/policies/access/ is cited from ADR-3501 and the guide. Per section 7a, this AC is legal as the single AC on the story because the guide and the anchored TAC name no additional documented failure path for this mechanism (adjacent failure paths are owned by sibling stories on the same blueprint, not by this one).",
       "given": "the shipped guide file",
       "when": "the anatomy test greps for the two section headings, the curl example and the vendor URL",
       "then": "each string matches at least once in the file",
       "testable": true,
-      "scope": "library"
+      "scope": "library",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3502-edge-cloudflare-access-application-declaration",
+        "field": "interfaces.applicationDeclaration"
+      },
+      "vendorCitation": {
+        "url": "https://developers.cloudflare.com/cloudflare-one/policies/access/",
+        "verifiedOn": "2026-09-09"
+      }
     }
   ],
   "tacIds": [
     "TAC-3503-edge-cloudflare-access-policy-shape"
   ],
   "createdAt": "2026-09-07T16:00:00.000Z",
-  "updatedAt": "2026-09-07T16:00:00.000Z"
+  "updatedAt": "2026-09-10T00:00:00.000Z",
+  "description": "Story owns the guide-section presence assertion for the Zero Trust dashboard walk-through and the API alternative. Per section 7a, this story carries a single AC because the guide names no runtime failure path for the guide-section-presence mechanism."
 }

package/blueprints/edge-cloudflare-access/contributions/user-stories/edge-cloudflare-access-us-34106.json

@@ -11,17 +11,23 @@
   "acceptanceCriteria": [
     {
       "id": "AC-34106-1",
-      "description": "After 5 validate-pass and 5 validate-reject requests the audit sink holds 10 records each carrying exactly {email, outcome, timestamp, path}; the serialised JSON of every record contains no substring of the JWT (header, payload or signature), no Authorization value and no header names beyond path.",
+      "description": "After 5 validate-pass and 5 validate-reject requests the audit sink holds 10 records each carrying exactly {email, outcome, timestamp, path}; the serialised JSON of every record contains no substring of the JWT (header, payload or signature), no Authorization value and no header names beyond path. Per section 7a, this AC is legal as the single AC on the story because the guide and the anchored TAC name no additional documented failure path for this mechanism (adjacent failure paths are owned by sibling stories on the same blueprint, not by this one).",
       "given": "the shipped createAccessValidator wired with a spy audit sink and 10 requests (5 pass, 5 reject)",
       "when": "the requests dispatch through the validator",
       "then": "10 sink records, each with allowed keys only, none containing forbidden substrings",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3501-edge-cloudflare-access-jwt-validator",
+        "field": "interfaces.createAccessValidator"
+      }
     }
   ],
   "tacIds": [
     "TAC-3504-edge-cloudflare-access-audit-sink"
   ],
   "createdAt": "2026-09-07T16:00:00.000Z",
-  "updatedAt": "2026-09-07T16:00:00.000Z"
+  "updatedAt": "2026-09-10T00:00:00.000Z",
+  "description": "Story owns the audit-event record-shape assertion (10 records across 5 pass and 5 reject requests, exact key set, no token substring). Reject-branch outcomes are covered by US-34102; per section 7a, this story carries a single AC because the record-shape mechanism has no additional documented failure path in the guide or the anchored TAC."
 }