rcf-lite 0.26.0 → 0.28.0

package/blueprints/edge-cloudflare-access/contributions/user-stories/edge-cloudflare-access-us-34107.json

@@ -11,17 +11,82 @@
   "acceptanceCriteria": [
     {
       "id": "AC-34107-1",
-      "description": "When the request presents the elicited service-auth id and secret (as CF-Access-Client-Id and CF-Access-Client-Secret headers), the validator observes the pair, records outcome=bypass in the audit event with the metadata-only shape, and delegates to the handler as authenticated with request.auth.email='service:'+id. Break-glass is disabled unless the elicited pair is applied.",
+      "description": "When the request presents the elicited service-auth id and secret (as CF-Access-Client-Id and CF-Access-Client-Secret headers), the validator observes the pair, records outcome=bypass in the audit event with the metadata-only shape, and delegates to the handler as authenticated with request.auth.email='service:'+id. Break-glass is disabled unless the elicited pair is applied. Applying agent sets: the applying agent sets the elicited access-bypass-service-auth-id and its paired secret; the bypass observable (delegates as authenticated with request.auth.email='service:'+id) is a pure function of that pair.",
       "given": "the createAccessValidator wired with an elicited bypass-service-auth pair and a request presenting the paired headers",
       "when": "the request dispatches through the validator",
       "then": "the handler receives request.auth with the service principal and the audit sink records outcome=bypass with allowed keys only",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-3501-edge-cloudflare-access-jwt-validator",
+        "field": "interfaces.createAccessValidator"
+      },
+      "vendorCitation": {
+        "url": "https://developers.cloudflare.com/cloudflare-one/identity/service-tokens/",
+        "verifiedOn": "2026-09-09"
+      }
+    },
+    {
+      "id": "AC-34107-2",
+      "description": "Given no bypass-service-auth id is elicited (empty string, break-glass disabled), when a request presents CF-Access-Client-Id and CF-Access-Client-Secret headers, the validator ignores the bypass path entirely and falls through to normal JWT validation; the audit event carries outcome:\"reject\" reason:\"jwt-missing\" when no JWT accompanies the headers, never outcome:\"bypass\".",
+      "given": "the fixture applied source with break-glass disabled (access-bypass-service-auth-id empty)",
+      "when": "a request presents CF-Access-Client-Id and CF-Access-Client-Secret headers but no Cf-Access-Jwt-Assertion",
+      "then": "the validator refuses 401 with outcome \"reject\" reason \"jwt-missing\"; no bypass principal is set and no outcome \"bypass\" audit event fires",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3501-edge-cloudflare-access-jwt-validator",
+        "field": "interfaces.createAccessValidator"
+      }
+    },
+    {
+      "id": "AC-34107-3",
+      "description": "Given the elicited break-glass service-auth pair is present, when a request presents CF-Access-Client-Id that does not match the elicited id and any CF-Access-Client-Secret, the validator refuses 401 with outcome:\"reject\" reason:\"bypass-id-mismatch\"; no bypass principal is set on request.auth and no outcome:\"bypass\" audit event fires. Applying agent sets: the applying agent sets the elicited access-bypass-service-auth-id; a request whose CF-Access-Client-Id differs from the applied value is refused with bypass-id-mismatch.",
+      "given": "the fixture applied source with break-glass enabled and the elicited id and secret configured",
+      "when": "a request presents a wrong CF-Access-Client-Id with any secret",
+      "then": "the validator refuses 401 with outcome \"reject\" reason \"bypass-id-mismatch\" and no bypass principal is set",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-3501-edge-cloudflare-access-jwt-validator",
+        "field": "interfaces.createAccessValidator"
+      }
+    },
+    {
+      "id": "AC-34107-4",
+      "description": "Given the elicited break-glass service-auth pair is present, when a request presents the correct CF-Access-Client-Id with a wrong CF-Access-Client-Secret, the validator refuses 401 with outcome:\"reject\" reason:\"bypass-secret-mismatch\" using a constant-time compare; no bypass principal is set and no outcome:\"bypass\" audit event fires. Applying agent sets: the applying agent sets the elicited paired secret; a request whose CF-Access-Client-Secret differs from the applied value is refused with bypass-secret-mismatch under a constant-time compare.",
+      "given": "the fixture applied source with break-glass enabled and the elicited pair configured",
+      "when": "a request presents the correct client id but a wrong secret",
+      "then": "the validator refuses 401 with outcome \"reject\" reason \"bypass-secret-mismatch\" and no bypass principal is set",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-3501-edge-cloudflare-access-jwt-validator",
+        "field": "interfaces.createAccessValidator"
+      }
+    },
+    {
+      "id": "AC-34107-5",
+      "description": "Given the elicited break-glass service-auth pair is present, when a request presents only one of CF-Access-Client-Id or CF-Access-Client-Secret (never both), the validator falls through to normal JWT validation and refuses 401 with outcome:\"reject\" reason:\"jwt-missing\" (or whichever JWT-path reason applies); no partial-bypass principal is set and no outcome:\"bypass\" audit event fires. Applying agent sets: the applying agent sets both halves of the elicited bypass pair; a request presenting only one half falls through to JWT validation and is refused with the appropriate JWT-path reason.",
+      "given": "the fixture applied source with break-glass enabled and the elicited pair configured",
+      "when": "a request presents exactly one of CF-Access-Client-Id or CF-Access-Client-Secret",
+      "then": "the validator falls through to JWT validation; no bypass principal is set and no bypass audit event fires",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-3501-edge-cloudflare-access-jwt-validator",
+        "field": "interfaces.createAccessValidator"
+      }
     }
   ],
   "tacIds": [
     "TAC-3501-edge-cloudflare-access-jwt-validator"
   ],
   "createdAt": "2026-09-07T16:00:00.000Z",
-  "updatedAt": "2026-09-07T16:00:00.000Z"
+  "updatedAt": "2026-09-09T13:00:00.000Z"
 }

package/blueprints/edge-cloudflare-access/contributions/user-stories/edge-cloudflare-access-us-34108.json

@@ -11,17 +11,19 @@
   "acceptanceCriteria": [
     {
       "id": "AC-34108-1",
-      "description": "Two applied combinations are exercised on the extended admin-console fixture: with ?caps=principalDirectory,roleModel,auditLog,zeroTrustGate the sign-in surface renders [data-surface=access-gated] and no [data-surface=local-login] is present; with ?caps=principalDirectory,roleModel,auditLog the sign-in surface renders [data-surface=local-login] and no [data-surface=access-gated] is present. Both combinations exercise the shipped pack check AC-21815-1 on application-admin-console.pack.mjs (pack check fires only on the gated combination).",
+      "description": "Two applied combinations are exercised on the extended admin-console fixture: with ?caps=principalDirectory,roleModel,auditLog,zeroTrustGate the sign-in surface renders [data-surface=access-gated] and no [data-surface=local-login] is present; with ?caps=principalDirectory,roleModel,auditLog the sign-in surface renders [data-surface=local-login] and no [data-surface=access-gated] is present. Both combinations exercise the shipped pack check AC-21815-1 on application-admin-console.pack.mjs (pack check fires only on the gated combination). Per section 7a, this AC is legal as the single AC on the story because the guide and the anchored TAC name no additional documented failure path for this mechanism (adjacent failure paths are owned by sibling stories on the same blueprint, not by this one).",
       "given": "the extended admin-console pack fixture with the two caps combinations",
       "when": "the pack runs against each combination",
       "then": "AC-21815-1 fires on the gated combination and passes; the existing v1.0.0 surface renders on the non-gated combination and its own checks pass",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [
     "TAC-3502-edge-cloudflare-access-application-declaration"
   ],
   "createdAt": "2026-09-07T16:00:00.000Z",
-  "updatedAt": "2026-09-07T16:00:00.000Z"
+  "updatedAt": "2026-09-10T00:00:00.000Z",
+  "description": "Story owns the admin-console sign-in surface flip between the access-gated data-surface and the local-login data-surface. Both applied capability-set combinations are exercised in-AC. Per section 7a, this story carries a single AC because the capability-set flip mechanism has no additional documented failure path in the guide or the anchored TAC."
 }

package/blueprints/edge-cloudflare-access/contributions/user-stories/edge-cloudflare-access-us-34109.json

@@ -5,23 +5,29 @@
   "version": "1.0.0",
   "status": "approved",
   "title": "Real-account gated URL round-trip against a scheduled Access-configured hostname",
-  "asA": "HQ operator running the real-account gated-URL smoke against a scheduled Access-configured hostname",
+  "asA": "operator running the real-account gated-URL smoke against a scheduled Access-configured hostname",
   "iWant": "the probe to fire against the hostname when the env vars are present and record accountBoundSkipped when not",
   "soThat": "the mechanism-reach claim is proven on a real Cloudflare Access instance without ever failing the shelf gate on the absence of an account",
   "acceptanceCriteria": [
     {
       "id": "AC-34109-1",
-      "description": "With CI_HAS_CLOUDFLARE_ACCOUNT=true and CF_ACCESS_HOST=<hostname>, a plain fetch against https://<hostname>/ follows the redirect chain and terminates at an https://<team>.cloudflareaccess.com/ URL (the Access UI). Without either env var the probe records accountBoundSkipped=true and aggregateVerdict=pass per spec section 3.5.",
+      "description": "With CI_HAS_CLOUDFLARE_ACCOUNT=true and CF_ACCESS_HOST=<hostname>, a plain fetch against https://<hostname>/ follows the redirect chain and terminates at an https://<team>.cloudflareaccess.com/ URL (the Access UI). Without either env var the probe records accountBoundSkipped=true and aggregateVerdict=pass per spec section 3.5. Applying agent sets: the applying agent sets CF_ACCESS_HOST (the hostname the account-bound probe fetches) and toggles CI_HAS_CLOUDFLARE_ACCOUNT in the operator environment for the account-bound run. Per section 7a, this AC is legal as the single AC on the story because the guide and the anchored TAC name no additional documented failure path for this mechanism (adjacent failure paths are owned by sibling stories on the same blueprint, not by this one).",
       "given": "the run-real-account-gated-url.mjs probe shim and the two env vars",
       "when": "the probe runs",
       "then": "in the CI-with-account path the redirect chain reports cloudflareaccess.com as terminal; in the without-env path accountBoundSkipped is true",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template",
+      "vendorCitation": {
+        "url": "https://developers.cloudflare.com/cloudflare-one/policies/access/",
+        "verifiedOn": "2026-09-09"
+      }
     }
   ],
   "tacIds": [
     "TAC-3502-edge-cloudflare-access-application-declaration"
   ],
   "createdAt": "2026-09-07T16:00:00.000Z",
-  "updatedAt": "2026-09-07T16:00:00.000Z"
+  "updatedAt": "2026-09-10T00:00:00.000Z",
+  "description": "Story owns the account-bound Access redirect probe with the accountBoundSkipped fall-through. Per section 7a, this story carries a single AC because the redirect-shape mechanism has no additional documented failure path in the guide or the anchored TAC."
 }

package/blueprints/edge-cloudflare-access/contributions/user-stories/edge-cloudflare-access-us-34110.json

@@ -0,0 +1,33 @@
+{
+  "usId": "edge-cloudflare-access-US-34110",
+  "prdId": "PRD-001",
+  "reqId": "edge-cloudflare-access-REQ-007",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Guide walk-through names every dashboard-owned policy input per policy-shape and every shipped elicit",
+  "asA": "operator issuing an Access policy from the dashboard side",
+  "iWant": "the guide to name every input the dashboard needs per policy shape (email domain for email-domain; group name and identity provider for group-membership; service-token id and secret elicits for service-token-only and service-token-plus-email-domain; application/path scope for every shape) and every shipped elicit",
+  "soThat": "a policy issued from the guide walk-through is complete without back-and-forth between the guide and the vendor docs",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-34110-1",
+      "description": "The shipped guide (guide/<slug>.md within this blueprint) contains a section Policy shape enum that names, per policy-shape option, the required dashboard-owned inputs: email-domain names the required email-domain input; group-membership names the required group-name input and the required identity-provider selection; service-token-only names the required service-token id and paired secret (linked to the bypass-service-auth-id elicit); service-token-plus-email-domain names both the email-domain and the service-token pair; every shape names the required application-vs-path scope input. The guide additionally names every shipped elicit (application-host, selfhosted-app-id, audience, jwks-url, policy-shape, bypass-service-auth-id) with its runtime effect. Per section 7a, this AC is legal as the single AC on the story because the guide and the anchored TAC name no additional documented failure path for this mechanism (adjacent failure paths are owned by sibling stories on the same blueprint, not by this one).",
+      "given": "the shipped guide file",
+      "when": "a source-tree grep asserts the required substrings per shape and elicit",
+      "then": "every required substring is present; a fixture that omits any of them refuses the probe with a stable code guide.policy-inputs-missing naming which substring is absent",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3503-edge-cloudflare-access-policy-shape",
+        "field": "responsibilities.policyIssueGuide"
+      }
+    }
+  ],
+  "tacIds": [
+    "TAC-3503-edge-cloudflare-access-policy-shape"
+  ],
+  "createdAt": "2026-09-09T00:00:00.000Z",
+  "updatedAt": "2026-09-10T00:00:00.000Z",
+  "description": "Story owns the guide-section presence assertion for the policy-shape enum. Per section 7a, this story carries a single AC because the guide names no runtime failure path for the guide-section-presence mechanism."
+}

package/blueprints/edge-cloudflare-access/docs/topics.md

@@ -59,12 +59,12 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | platform-docker-compose-host | 38101-38899 | 39xx | shipped v1.0.0 | `containerHostContract` |
 | edge-cloudflare-tunnel | 39101-39899 | 40xx | shipped v1.0.0 | `edgeIngressBridge` |
 
-US 34101-34109 sit at the LOW end of the 34101-34899 band on purpose (watchpost run-4 lesson). ADR/TAC suffixes for this blueprint use the 3501-3599 block, continuing the shelf pattern.
+US 34101-34109 sit at the LOW end of the 34101-34899 band on purpose. ADR/TAC suffixes for this blueprint use the 3501-3599 block, continuing the shelf pattern.
 
 ## Shared expectations for future composing blueprints
 
 - Reuse `edgeAuthenticationGate` exactly as spelled here when your blueprint holds an opinion on the edge authentication gate contract; contribute your own scope:global ADR on that string and let composition surface the pairing.
-- Consumer blueprints reading the `zeroTrustGate` capability declared on `blueprint.json` per section 6a of `blueprint-authoring.md` obtain the Access-gated composition at apply time via the T-5 visual-round capability-declaration mechanism.
+- Consumer blueprints reading the `zeroTrustGate` capability declared on `blueprint.json` per section 6a of `blueprint-authoring.md` obtain the Access-gated composition at apply time via the visual-round capability-declaration mechanism.
 
 ## Deliberate-conflict statement
 

package/blueprints/edge-cloudflare-rate-limiting/CHANGELOG.md

@@ -1,8 +1,39 @@
 # edge-cloudflare-rate-limiting changelog
 
-## 1.0.0 (round 6 T-6, 2026-09-07)
+## 1.1.3 - 2026-09-10
 
-- First shipped version. Zone-level rate limiting as an edge gate in front of Worker handlers per the ratified `cloudflare-round-6-spec-2026-09-06.md` section 5.6.
+Positive-evidence rule alignment on the probe pack skip path (authoring standard section 7d); vendor citation on the guide-section AC; register tidy in shipped prose (no capability change).
+
+- Probes and fixture: the account-bound skip return on `contributions/probes/real-account-burst-and-429.mjs` now carries a `reason` field naming the exact env var(s) that were unset; added a "Declared env vars" section to the shared fixture README (`packages/rcf-lite/test/fixtures/cf-edge/README.md`), per authoring standard section 7d. Skip-path probe reports regenerated so the shipped shape carries the new field.
+- AC-36102-1 on US-36102 now carries a vendorCitation pointing at the Cloudflare WAF rate-limiting rules documentation.
+
+## 1.1.2 - 2026-09-10
+
+Capability token named in the requirements layer; single-mechanism story legality notes; owner reference for the drift-audit and request-event record shapes.
+
+- Extended REQ-001 description to name the declared `edgeRateLimit` capability token verbatim with a one-line runtime clause tying the token to the rules-manifest mechanism that delivers it.
+- Added AC-36101-2 on US-36101 as a fixed AC that binds the manifest-declared `edgeRateLimit` token to the presence of at least one schema-valid rule under the applied manifest directory.
+- Appended the section 7a legality note to AC-36101-1, AC-36102-1 and AC-36105-1 recording that each single-AC story's mechanism has no additional documented failure path in the guide or the anchored TAC (adjacent failure paths are owned by sibling stories, not by these).
+- Rewrote REQ-004 description to reference the owning TAC (`TAC-3703-edge-cloudflare-rate-limiting-drift-audit-runner.purpose`) for the drift-audit record shape and the runtime request-event record shape, rather than restating the shapes verbatim.
+
+## 1.1.1 (register-sweep patch, 2026-09-10)
+
+- Register: neutral wording in shipped prose (no capability change).
+
+## 1.1.0 - 2026-09-09
+
+Adds REQ-layer backing for elicited options and extends the AC set to cover every documented failure path.
+- Added failure-path ACs to US-36103 (origin-not-executed AC-36103-2 closes F-1: 429 refuses before origin), US-36104 (AC-36104-2 fake-clock cadence assertion closes F-2; AC-36104-3..7 close F-5 drift-runner failure paths for missing zone id, API auth, throttled, malformed and timeout).
+- Split the drift-audit record shape from the runtime request-event record shape: drift records carry `{ruleId, outcome, timestamp, diff}` (no `clientIpHash`, no client on the API path); request-event records carry `{ruleId, clientIpHash, outcome, timestamp}` with a hashed prefix. REQ-004, TAC-3703 responsibilities, AC-36104-1 and AC-36107-1 all now use these exact shapes (closes specimen F-3).
+- Clarified TAC-3701 and REQ-001 that the manifest schema has seven required fields plus one optional `description` field (aligns TAC with the shipped schema; closes specimen F-4).
+- Every REQ now carries `deliveredBy`; every AC carries `disposition`; ACs referencing owner-owned literals carry `ownerRef`.
+- Chain-consistency lint reports 0 findings on both passes.
+- Finished the split of the drift-audit record shape from the request-event shape by rewriting the TAC-3703 purpose second sentence and the guide's `## Drift audit` section to state the drift record as `{ruleId, outcome, timestamp, diff}` and the request-event record as `{ruleId, clientIpHash, outcome, timestamp}`; the README event-secrecy row assertion now names both shapes. Split every bundled single-AC story on a per-failure-path basis: US-36106 (canonical-pass + SIMULATE_SCHEMA_INVALID-fail), US-36107 (canonical-shape + SIMULATE_EVENT_LEAK_IP-fail), US-36108 (canonical-pass + SIMULATE_MANIFEST_MISSING-fail); each new AC carries a concrete oracle (probe verdict + named field) and an `ownerRef`. US-36101 AC-36101-1 and US-36103 AC-36103-1/-2 are marked `template` naming the values the applying agent sets (the rate-limit-rules-dir path, per-rule id/expression/threshold/period/characteristics/action/duration, the elicited rate-limit-zone-id, and CF_RATE_LIMIT_URL for the account-bound probe). Genuinely single-mechanism stories (US-36101, US-36102, US-36105) carry the section-7a note inside the story `description` field, not in a schema-illegal new field.
+
+
+## 1.0.0 (round 6, 2026-09-07)
+
+- First shipped version. Zone-level rate limiting as an edge gate in front of Worker handlers.
 - Five REQs, eight USs, three TACs, four ADRs. Twenty contributions total.
 - Ships the local rate-limit rules manifest schema (draft-07), the operator-facing management surface guide with both wrangler and dashboard flows, the drift-audit runner realisation on the `cf-edge` fixture and the composition ADR with `security-auth-magic-link`.
 - Mints capability `edgeRateLimit` and global topic `edgeThrottleContract` (ADR-3701, scope global).

package/blueprints/edge-cloudflare-rate-limiting/README.md

@@ -1,6 +1,6 @@
 # edge-cloudflare-rate-limiting
 
-Zone-level rate limiting as an edge gate in front of Worker handlers, configured through a local manifest the applying project commits and applies to the live Cloudflare zone via a documented wrangler or dashboard flow. Ships v1.0.0 of the round-6 T-6 track per `projects/blueprint-library/specs/cloudflare-round-6-spec-2026-09-06.md` section 5.6.
+Zone-level rate limiting as an edge gate in front of Worker handlers, configured through a local manifest the applying project commits and applies to the live Cloudflare zone via a documented wrangler or dashboard flow.
 
 - **Category:** `edge`.
 - **Capability provided:** `edgeRateLimit`.
@@ -48,7 +48,7 @@ Four Node-only probes under `contributions/probes/`; three run in CI, one is acc
 | --- | --- | --- | --- |
 | `manifest-presence.mjs` | AC-36101-1 (also AC-36108-1 under `SIMULATE_MANIFEST_MISSING=true`) | false | Reads `cf-edge/cloudflare/rate-limits/`, asserts every file parses, carries the seven required fields and holds no plaintext secret. |
 | `manifest-schema-validate.mjs` | AC-36106-1 | false | Validates every manifest file against the shipped JSON Schema. Under `SIMULATE_SCHEMA_INVALID=true` writes a scratch file missing `threshold` and fails. |
-| `event-secrecy.mjs` | AC-36107-1 | false | Drives the shipped drift-audit runner realisation with a synthetic manifest and a fake fetch; asserts every drift record carries only `{ruleId, clientIpHash, outcome, timestamp, diff}`. Under `SIMULATE_EVENT_LEAK_IP=true` the runner injects a full IP and the probe fails. |
+| `event-secrecy.mjs` | AC-36107-1 | false | Drives the shipped drift-audit runner realisation with a synthetic manifest and a fake fetch; asserts every drift-audit and request-event record matches the metadata-only shapes declared on `TAC-3703-edge-cloudflare-rate-limiting-drift-audit-runner.purpose`. Under `SIMULATE_EVENT_LEAK_IP=true` the runner injects a full IP and the probe fails. |
 | `real-account-burst-and-429.mjs` | AC-36103-1 | true | Fires an in-process burst against `CF_RATE_LIMIT_URL` under `CI_HAS_CLOUDFLARE_ACCOUNT=true` and asserts the (N+1)th and subsequent responses return 429 with `Retry-After` and `Cf-Ray`. Without either env var records `accountBoundSkipped: true` and aggregates to `pass` per spec section 3.5 and ruling 6. |
 
 ### Ruling 6 restated
@@ -66,7 +66,7 @@ When both blueprints apply, the zone-level rate rule (characteristic set: IP-per
 
 ## Vendor citations
 
-- Cloudflare WAF rate-limiting rules: `https://developers.cloudflare.com/waf/rate-limiting-rules/` (documents `expression`, `threshold`, `period`, `characteristics`, `action`, `duration`; fetched 200 on 2026-09-07 for the round-6 T-6 ship).
+- Cloudflare WAF rate-limiting rules: `https://developers.cloudflare.com/waf/rate-limiting-rules/` (documents `expression`, `threshold`, `period`, `characteristics`, `action`, `duration`; fetched 200 on 2026-09-07).
 
 ## Known mechanism-reach gaps
 

package/blueprints/edge-cloudflare-rate-limiting/blueprint.json

@@ -1,6 +1,6 @@
 {
   "slug": "edge-cloudflare-rate-limiting",
-  "version": "1.0.0",
+  "version": "1.1.3",
   "category": "edge",
   "capabilities": [
     "edgeRateLimit"

package/blueprints/edge-cloudflare-rate-limiting/contributions/probes/real-account-burst-and-429.mjs

@@ -36,14 +36,22 @@ export default async function runProbe() {
   const has = process.env.CI_HAS_CLOUDFLARE_ACCOUNT === 'true';
   const url = process.env.CF_RATE_LIMIT_URL || '';
   if (!has || !url) {
+    // Positive-evidence rule (authoring standard section 7d): the skip
+    // record names the exact env var(s) that were unset in `reason`,
+    // so a `pass` verdict is legal without positive evidence.
+    const unset = [];
+    if (!has) unset.push('CI_HAS_CLOUDFLARE_ACCOUNT');
+    if (!url) unset.push('CF_RATE_LIMIT_URL');
+    const reason = unset.join(', ');
     return {
       results: [{
         anchorAcId: 'AC-36103-1',
         verdict: 'pass',
         accountBoundSkipped: true,
-        detail: `accountBoundSkipped: CI_HAS_CLOUDFLARE_ACCOUNT=${has} CF_RATE_LIMIT_URL=${url ? 'set' : 'unset'}; per spec section 3.5 and ruling 6 pass-with-skip.`,
+        reason,
+        detail: `accountBoundSkipped: ${reason} unset; per spec section 3.5 and ruling 6 pass-with-skip.`,
       }],
-      extra: { accountBoundSkipped: true },
+      extra: { accountBoundSkipped: true, reason },
     };
   }
   const threshold = Number.parseInt(process.env.CF_RATE_LIMIT_THRESHOLD || '60', 10);

package/blueprints/edge-cloudflare-rate-limiting/contributions/requirements/edge-cloudflare-rate-limiting-req-001.json

@@ -2,7 +2,7 @@
   "reqId": "edge-cloudflare-rate-limiting-REQ-001",
   "prdId": "PRD-001",
   "title": "The rate-limit rule set is committed to the applying project as a local manifest under cloudflare/rate-limits/, one JSON file per rule",
-  "description": "The applying project holds its rate-limit rule set as a set of JSON documents under the elicited rate-limit-rules-dir (default cloudflare/rate-limits/), one file per rule per ADR-3703. Every manifest file declares the seven documented fields the Cloudflare WAF rate-limiting rules contract names per https://developers.cloudflare.com/waf/rate-limiting-rules/: id (a stable operator-facing string), expression (the WAF rules-language expression string), threshold (positive integer), period (seconds), characteristics (non-empty array of stable characteristic strings), action (block or challenge or log or managed_challenge), duration (seconds, the length of the block window). No rule references a secret in plaintext; the zone id is elicited and stored via the applied secretsManagement companion. The manifest is the source of truth an operator applies via the wrangler or dashboard flow named in the guide; no committed script writes the rules to the live zone.",
+  "description": "The applying project holds its rate-limit rule set as a set of JSON documents under the elicited rate-limit-rules-dir (default cloudflare/rate-limits/), one file per rule per ADR-3703. Every manifest file declares the seven required documented fields the Cloudflare WAF rate-limiting rules contract names per https://developers.cloudflare.com/waf/rate-limiting-rules/: id (a stable operator-facing string), expression (the WAF rules-language expression string), threshold (positive integer), period (seconds), characteristics (non-empty array of stable characteristic strings), action (block or challenge or log or managed_challenge), duration (seconds, the length of the block window). No rule references a secret in plaintext; the zone id is elicited and stored via the applied secretsManagement companion. The manifest is the source of truth an operator applies via the wrangler or dashboard flow named in the guide; no committed script writes the rules to the live zone. Delivers the declared `edgeRateLimit` capability token: the shipped rules manifest is the source of truth an operator promotes to the live Cloudflare zone, so once the applying project ships one manifest file per rule the `edgeRateLimit` promise binds every request the zone answers.",
   "category": "functional",
   "domain": "edge",
   "priority": "must",
@@ -13,5 +13,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-07T22:00:00.000Z",
-  "updatedAt": "2026-09-07T22:00:00.000Z"
+  "updatedAt": "2026-09-10T00:00:00.000Z",
+  "deliveredBy": {
+    "tacId": "TAC-3701-edge-cloudflare-rate-limiting-manifest-schema",
+    "field": "interfaces.schema"
+  }
 }

package/blueprints/edge-cloudflare-rate-limiting/contributions/requirements/edge-cloudflare-rate-limiting-req-002.json

@@ -13,5 +13,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-07T22:00:00.000Z",
-  "updatedAt": "2026-09-07T22:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00.000Z",
+  "deliveredBy": {
+    "tacId": "TAC-3702-edge-cloudflare-rate-limiting-management-surface-doc",
+    "field": "interfaces.guide"
+  }
 }

package/blueprints/edge-cloudflare-rate-limiting/contributions/requirements/edge-cloudflare-rate-limiting-req-003.json

@@ -13,5 +13,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-07T22:00:00.000Z",
-  "updatedAt": "2026-09-07T22:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00.000Z",
+  "deliveredBy": {
+    "adrId": "ADR-3701-edge-cloudflare-rate-limiting-throttle-contract",
+    "field": "decision.overThresholdBehaviour"
+  }
 }

package/blueprints/edge-cloudflare-rate-limiting/contributions/requirements/edge-cloudflare-rate-limiting-req-004.json

@@ -2,7 +2,7 @@
   "reqId": "edge-cloudflare-rate-limiting-REQ-004",
   "prdId": "PRD-001",
   "title": "Drift audit: an opt-in scheduled runner reads live zone rules via the Cloudflare API and diffs against the local manifest, reporting mismatches metadata-only",
-  "description": "The blueprint ships a scheduled drift-audit runner (TAC-3703) the applying project can wire behind the elicited rate-limit-drift-audit-cadence per ADR-3704. When enabled (daily or hourly), the runner fetches the live rate-limiting rules on the elicited zone via the Cloudflare API, diffs the returned rule set against the local manifest field-by-field, and constructs one drift-audit record per mismatched rule. Each record is written through the applied logger's audit sink with the metadata-only shape {ruleId, clientIpHash, outcome, timestamp} plus the diff fields; a record never carries a full client IP, a request body or a user agent per REQ-005's event-secrecy discipline. The runner's report artefact writes to the standard blueprint-report location under .rcf/reports/blueprints/edge-cloudflare-rate-limiting/. When the elicited cadence is off, the runner is not wired.",
+  "description": "The blueprint ships a scheduled drift-audit runner (TAC-3703) the applying project can wire behind the elicited rate-limit-drift-audit-cadence per ADR-3704. When enabled (daily or hourly), the runner fetches the live rate-limiting rules on the elicited zone via the Cloudflare API, diffs the returned rule set against the local manifest field-by-field, and constructs one drift-audit record per mismatched rule. The drift-audit record shape is the metadata-only shape named on `TAC-3703-edge-cloudflare-rate-limiting-drift-audit-runner.purpose` (drift-audit record clause); the runtime request-event record shape emitted by the applied guard on a live client request is the separate shape named on the same TAC field (request-event record clause). Neither shape carries a full IP, a request body or a user agent (event-secrecy discipline per AC-36107-1). The runner report artefact writes to `.rcf/reports/blueprints/edge-cloudflare-rate-limiting/`. When the elicited cadence is off, the runner is not wired.",
   "category": "operational",
   "domain": "edge",
   "priority": "must",
@@ -13,5 +13,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-07T22:00:00.000Z",
-  "updatedAt": "2026-09-07T22:00:00.000Z"
+  "updatedAt": "2026-09-10T00:00:00.000Z",
+  "deliveredBy": {
+    "tacId": "TAC-3703-edge-cloudflare-rate-limiting-drift-audit-runner",
+    "field": "interfaces.createDriftAuditRunner"
+  }
 }

package/blueprints/edge-cloudflare-rate-limiting/contributions/requirements/edge-cloudflare-rate-limiting-req-005.json

@@ -13,5 +13,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-07T22:00:00.000Z",
-  "updatedAt": "2026-09-07T22:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00.000Z",
+  "deliveredBy": {
+    "adrId": "ADR-3702-edge-cloudflare-rate-limiting-layering",
+    "field": "decision.layering"
+  }
 }

package/blueprints/edge-cloudflare-rate-limiting/contributions/tacs/tac-3701-edge-cloudflare-rate-limiting-manifest-schema.json

@@ -5,7 +5,7 @@
   "version": "1.0.0",
   "status": "approved",
   "name": "Rate-limit rule manifest schema and manifest layout",
-  "purpose": "The shipped JSON Schema (draft-07) at blueprints/edge-cloudflare-rate-limiting/contributions/schemas/rate-limit-rule.schema.json is the single source of truth for the shape of one manifest file under the elicited rate-limit-rules-dir. The schema names the seven Cloudflare WAF rate-limiting rules fields per https://developers.cloudflare.com/waf/rate-limiting-rules/ (id, expression, threshold, period, characteristics, action, duration), their types (string, string, positive integer, positive integer, non-empty string array, enum of block/challenge/log/managed_challenge, positive integer), and the additionalProperties: false stance. The manifest-schema-validate probe reads every file in the fixture manifest directory and validates against this schema; the manifest-presence probe asserts the seven required fields are all present. This TAC anchors AC-36101-1, AC-36106-1 and AC-36108-1.",
+  "purpose": "The shipped JSON Schema (draft-07) at blueprints/edge-cloudflare-rate-limiting/contributions/schemas/rate-limit-rule.schema.json is the single source of truth for the shape of one manifest file under the elicited rate-limit-rules-dir. The schema declares seven required Cloudflare WAF rate-limiting rules fields per https://developers.cloudflare.com/waf/rate-limiting-rules/ (id, expression, threshold, period, characteristics, action, duration) plus one optional operator-facing description field, their types (string, string, positive integer, positive integer, non-empty string array, enum of block/challenge/log/managed_challenge, positive integer, and an optional string description), and the additionalProperties: false stance. The manifest-schema-validate probe reads every file in the fixture manifest directory and validates against this schema; the manifest-presence probe asserts the seven required fields are all present (the optional description is not required). This TAC anchors AC-36101-1, AC-36106-1 and AC-36108-1.",
   "responsibilities": [
     "Ship a JSON Schema (draft-07) at contributions/schemas/rate-limit-rule.schema.json naming the seven required fields, their types and additionalProperties: false (AC-36101-1, AC-36106-1).",
     "Ship the shape used by the manifest-presence probe to assert every manifest file carries the seven required fields (AC-36101-1).",
@@ -27,5 +27,5 @@
   ],
   "dependencies": [],
   "createdAt": "2026-09-07T22:00:00.000Z",
-  "updatedAt": "2026-09-07T22:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00.000Z"
 }

package/blueprints/edge-cloudflare-rate-limiting/contributions/tacs/tac-3703-edge-cloudflare-rate-limiting-drift-audit-runner.json

@@ -5,7 +5,7 @@
   "version": "1.0.0",
   "status": "approved",
   "name": "Drift-audit runner: read live zone rules via the Cloudflare API and diff against the local manifest",
-  "purpose": "The single project-side module realising the scheduled drift-audit runner. It fetches the live rate-limiting rules on the elicited zone via the Cloudflare API (GET /client/v4/zones/{zone_id}/rulesets), diffs the returned rule set against the local manifest file-by-file, and constructs one drift-audit record per mismatched rule. Records write through the applied logger's audit sink with the metadata-only shape {ruleId, clientIpHash, outcome, timestamp, diff}; no record carries a full IP, a request body or a user agent (event-secrecy discipline per REQ-004 and AC-36107-1). The runner is factory-driven for testability: probes and the anatomy test inject a fake fetch that returns a synthetic live-zone response. This TAC anchors AC-36104-1 and AC-36107-1.",
+  "purpose": "The single project-side module realising the scheduled drift-audit runner. It fetches the live rate-limiting rules on the elicited zone via the Cloudflare API (GET /client/v4/zones/{zone_id}/rulesets), diffs the returned rule set against the local manifest file-by-file, and constructs one drift-audit record per mismatched rule. Drift-audit records write through the applied logger's audit sink with the metadata-only shape {ruleId, outcome, timestamp, diff} (no clientIpHash on the drift record; drift is manifest-vs-live divergence, not a request event). The separate request-event record class emitted by the applied guard on a real client request carries {ruleId, clientIpHash, outcome, timestamp}; no record carries a full IP, a request body or a user agent (event-secrecy discipline per REQ-004 and AC-36107-1). The runner is factory-driven for testability: probes and the anatomy test inject a fake fetch that returns a synthetic live-zone response. This TAC anchors AC-36104-1 and AC-36107-1.",
   "responsibilities": [
     "Export createDriftAuditRunner({env, eventSink, fetch, clock, cadence}) returning {runOnce, schedule, stop} matching the drift-audit shape (AC-36104-1).",
     "Diff every manifest rule against every live rule and construct one drift record per mismatched rule, with the metadata-only shape {ruleId, outcome, timestamp, diff} (AC-36104-1, AC-36107-1).",
@@ -22,5 +22,5 @@
   ],
   "dependencies": [],
   "createdAt": "2026-09-07T22:00:00.000Z",
-  "updatedAt": "2026-09-07T22:00:00.000Z"
+  "updatedAt": "2026-09-09T12:00:00.000Z"
 }

package/blueprints/edge-cloudflare-rate-limiting/contributions/user-stories/edge-cloudflare-rate-limiting-us-36101.json

@@ -11,17 +11,41 @@
   "acceptanceCriteria": [
     {
       "id": "AC-36101-1",
-      "description": "The rate-limit manifest directory (default cloudflare/rate-limits/) exists in the applied project and holds at least one JSON file per rule; every file parses as JSON and carries the seven documented Cloudflare WAF rate-limiting rules fields (id, expression, threshold, period, characteristics, action, duration); no file body contains a plaintext Cloudflare API token or the elicited zone id (the zone id is elicited and stored via the applied secretsManagement companion).",
+      "description": "The rate-limit manifest directory (default cloudflare/rate-limits/) exists in the applied project and holds at least one JSON file per rule; every file parses as JSON and carries the seven documented Cloudflare WAF rate-limiting rules fields (id, expression, threshold, period, characteristics, action, duration); no file body contains a plaintext Cloudflare API token or the elicited zone id (the zone id is elicited and stored via the applied secretsManagement companion). Applying agent sets: the applying agent sets the elicited rate-limit-rules-dir path and, per rule file, the id, expression, threshold, period, characteristics, action and duration values. Per section 7a, this AC is legal as the single AC on the story because the guide and the anchored TAC name no additional documented failure path for this mechanism (adjacent failure paths are owned by sibling stories on the same blueprint, not by this one).",
       "given": "the cf-edge fixture with the two committed manifest files under cloudflare/rate-limits/",
       "when": "the manifest-presence probe scans the fixture directory",
       "then": "every manifest file parses, every file carries the seven required fields, and no file references a secret in plaintext",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-3701-edge-cloudflare-rate-limiting-manifest-schema",
+        "field": "interfaces.rate-limits"
+      },
+      "vendorCitation": {
+        "url": "https://developers.cloudflare.com/waf/rate-limiting-rules/",
+        "verifiedOn": "2026-09-09"
+      }
+    },
+    {
+      "id": "AC-36101-2",
+      "description": "The applied blueprint's manifest declares the `edgeRateLimit` capability token and the elicited rate-limit-rules-dir under the applied project holds at least one committed rule file that parses against the shipped rate-limit-rule schema; therefore the `edgeRateLimit` promise the manifest carries is backed by at least one operator-owned rule the applying project intends to run.",
+      "given": "the applied blueprint manifest at `blueprints/edge-cloudflare-rate-limiting/blueprint.json` and the applied fixture manifest directory under `cloudflare/rate-limits/`",
+      "when": "the manifest-presence probe reads the blueprint manifest and scans the applied rule directory",
+      "then": "the blueprint manifest lists `edgeRateLimit` on `capabilities[]` and the applied fixture has at least one schema-valid manifest file, so `edgeRateLimit` is a live promise the applying project can act on",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3701-edge-cloudflare-rate-limiting-manifest-schema",
+        "field": "interfaces.rate-limits"
+      }
     }
   ],
   "tacIds": [
     "TAC-3701-edge-cloudflare-rate-limiting-manifest-schema"
   ],
   "createdAt": "2026-09-07T22:00:00.000Z",
-  "updatedAt": "2026-09-07T22:00:00.000Z"
+  "updatedAt": "2026-09-10T00:00:00.000Z",
+  "description": "Story owns the applied-project manifest-directory shape assertion. The rate-limit-rule schema and its refusal path (SIMULATE_SCHEMA_INVALID) are owned by US-36106; a missing manifest file is owned by US-36108. Per section 7a, this story carries a single AC because its mechanism has no additional documented failure path in the guide or the anchored TAC."
 }

package/blueprints/edge-cloudflare-rate-limiting/contributions/user-stories/edge-cloudflare-rate-limiting-us-36102.json

@@ -11,17 +11,23 @@
   "acceptanceCriteria": [
     {
       "id": "AC-36102-1",
-      "description": "The blueprint guide at blueprints/edge-cloudflare-rate-limiting/guide/edge-cloudflare-rate-limiting.md documents an operator-facing management surface with both a wrangler command flow and a Cloudflare dashboard flow; each flow names the exact steps to apply one rule from a manifest file to the elicited zone; the guide references https://developers.cloudflare.com/waf/rate-limiting-rules/ as the vendor doc for the rule shape.",
+      "description": "The blueprint guide at blueprints/edge-cloudflare-rate-limiting/guide/edge-cloudflare-rate-limiting.md documents an operator-facing management surface with both a wrangler command flow and a Cloudflare dashboard flow; each flow names the exact steps to apply one rule from a manifest file to the elicited zone; the guide references https://developers.cloudflare.com/waf/rate-limiting-rules/ as the vendor doc for the rule shape. Per section 7a, this AC is legal as the single AC on the story because the guide and the anchored TAC name no additional documented failure path for this mechanism (adjacent failure paths are owned by sibling stories on the same blueprint, not by this one).",
       "given": "the shipped guide file in the blueprint tree",
       "when": "the anatomy test scans the guide for the wrangler headings, the dashboard headings and the vendor URL",
       "then": "both flow headings are present and the vendor URL appears",
       "testable": true,
-      "scope": "documentation"
+      "scope": "documentation",
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://developers.cloudflare.com/waf/rate-limiting-rules/",
+        "verifiedOn": "2026-09-10"
+      }
     }
   ],
   "tacIds": [
     "TAC-3702-edge-cloudflare-rate-limiting-management-surface-doc"
   ],
   "createdAt": "2026-09-07T22:00:00.000Z",
-  "updatedAt": "2026-09-07T22:00:00.000Z"
+  "updatedAt": "2026-09-10T00:00:00.000Z",
+  "description": "Story owns the guide-section presence assertion for the management-surface documentation. Per section 7a, this story carries a single AC because the guide names no runtime failure path for the guide-section-presence mechanism."
 }

package/blueprints/edge-cloudflare-rate-limiting/contributions/user-stories/edge-cloudflare-rate-limiting-us-36103.json

@@ -5,23 +5,42 @@
   "version": "1.0.0",
   "status": "approved",
   "title": "Over-threshold burst returns 429 with Retry-After and Cf-Ray on the (N+1)th request within the elicited duration",
-  "asA": "operator running the real-account burst probe against a scheduled HQ-owned URL configured with the manifest rule",
+  "asA": "operator running the real-account burst probe against a scheduled operator-owned URL configured with the manifest rule",
   "iWant": "the probe to fire an undici burst above the rule threshold and observe the (N+1)th and subsequent requests return HTTP 429 with a Retry-After header consistent with the elicited duration and a Cf-Ray header for the CF edge that served the refusal",
   "soThat": "the shipped over-threshold behaviour is verified against a real Cloudflare account and, in CI without CI_HAS_CLOUDFLARE_ACCOUNT, the probe records accountBound: skipped per ruling 6",
   "acceptanceCriteria": [
     {
       "id": "AC-36103-1",
-      "description": "When CI_HAS_CLOUDFLARE_ACCOUNT is true and CF_RATE_LIMIT_URL is set to a scheduled HQ-owned URL configured with the manifest rule, the real-account-burst-and-429 probe fires the elicited threshold plus one requests within the rule period and observes the (N+1)th and subsequent requests within the elicited duration return HTTP 429 with a Retry-After header value consistent with the elicited duration and a Cf-Ray header naming the CF edge; when either env var is absent the probe records accountBoundSkipped: true and the aggregate verdict is pass per spec section 3.5 and ruling 6.",
-      "given": "a scheduled HQ-owned URL configured with the manifest rule (or the accountBound: skipped fallback in CI)",
+      "description": "When CI_HAS_CLOUDFLARE_ACCOUNT is true and CF_RATE_LIMIT_URL is set to a scheduled operator-owned URL configured with the manifest rule, the real-account-burst-and-429 probe fires the elicited threshold plus one requests within the rule period and observes the (N+1)th and subsequent requests within the elicited duration return HTTP 429 with a Retry-After header value consistent with the elicited duration and a Cf-Ray header naming the CF edge; when either env var is absent the probe records accountBoundSkipped: true and the aggregate verdict is pass per spec section 3.5 and ruling 6. Applying agent sets: the applying agent sets the elicited rate-limit-zone-id, the per-rule threshold, period and duration values on each rate-limit rule file, and CF_RATE_LIMIT_URL in the operator environment for the account-bound probe.",
+      "given": "a scheduled operator-owned URL configured with the manifest rule (or the accountBound: skipped fallback in CI)",
       "when": "the real-account-burst-and-429 probe fires the burst (or records the skip)",
       "then": "the probe returns 429 with the two required headers on the over-threshold requests, or records accountBoundSkipped: true and aggregates to pass",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template",
+      "vendorCitation": {
+        "url": "https://developers.cloudflare.com/waf/rate-limiting-rules/",
+        "verifiedOn": "2026-09-09"
+      }
+    },
+    {
+      "id": "AC-36103-2",
+      "description": "Given a scheduled operator-owned URL whose origin Worker increments a monotonic origin counter on every invocation, when a client fires N+1 requests within the elicited period, the client observes 429 for the (N+1)th and subsequent requests AND the origin counter reads exactly N (the origin never executes on the refused requests); when either env var is absent the probe records accountBoundSkipped:true. Applying agent sets: the applying agent sets the same per-rule threshold, period and duration values plus the scheduled operator-owned URL whose origin Worker increments the monotonic counter.",
+      "given": "a scheduled operator-owned URL whose origin Worker exposes a monotonic origin-hit counter, or the accountBound:skipped fallback",
+      "when": "a client fires N+1 requests within the elicited period against the configured rule",
+      "then": "the client observes 429 on the (N+1)th and subsequent requests and the origin counter reads exactly N",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "template",
+      "ownerRef": {
+        "adrId": "ADR-3701-edge-cloudflare-rate-limiting-throttle-contract",
+        "field": "decision.overThresholdBehaviour"
+      }
     }
   ],
   "tacIds": [
     "TAC-3701-edge-cloudflare-rate-limiting-manifest-schema"
   ],
   "createdAt": "2026-09-07T22:00:00.000Z",
-  "updatedAt": "2026-09-07T22:00:00.000Z"
+  "updatedAt": "2026-09-09T13:00:00.000Z"
 }