rcf-lite 0.26.0 → 0.28.0

package/blueprints/edge-cloudflare-rate-limiting/contributions/user-stories/edge-cloudflare-rate-limiting-us-36104.json

@@ -11,17 +11,102 @@
   "acceptanceCriteria": [
     {
       "id": "AC-36104-1",
-      "description": "Given a synthetic drift scenario (a fixture manifest file that names threshold 10 and a fake live-zone response that reports threshold 20 on the same rule id), the drift-audit runner's diff step constructs one drift record per mismatched rule; the record carries {ruleId, outcome: driftDetected, timestamp, diff: [field: threshold, manifestValue: 10, liveValue: 20]} and NO full IP, NO request body, NO user agent; when the cadence elicit is off the runner is not wired and no report is written.",
+      "description": "Given a synthetic drift scenario (a fixture manifest file that names threshold 10 and a fake live-zone response that reports threshold 20 on the same rule id), the drift-audit runner's diff step constructs one drift record per mismatched rule; the record carries {ruleId, outcome: driftDetected, timestamp, diff: [{field: threshold, manifestValue: 10, liveValue: 20}]} and NEVER a clientIpHash key, NEVER a full IP, NEVER a request body, NEVER a user agent; when the cadence elicit is off the runner is not wired and no report is written.",
       "given": "the cf-edge fixture with the committed manifest and a synthetic Cloudflare API response with one mismatched rule",
       "when": "the drift-audit runner's diff step runs against the pair",
       "then": "one drift record is constructed per mismatched rule with the metadata-only shape and the report writes to .rcf/reports/blueprints/edge-cloudflare-rate-limiting/",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-36104-2",
+      "description": "Given a fake clock and cadence \"daily\", when the runner is scheduled and 25 hours of virtual time elapse, the drift-audit runOnce fires exactly once; cadence \"hourly\" fires 25 times; cadence \"off\" fires zero times and produces no scheduled timer; stopping and restarting the runner never leaves a duplicate timer.",
+      "given": "the fake-clock harness with cadence set successively to off, daily and hourly",
+      "when": "the runner is scheduled with the harness clock and virtual time advances 25 hours",
+      "then": "daily fires exactly once, hourly exactly 25 times, off fires zero times, and stop+restart yields exactly one timer per active cadence",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3703-edge-cloudflare-rate-limiting-drift-audit-runner",
+        "field": "interfaces.createDriftAuditRunner"
+      }
+    },
+    {
+      "id": "AC-36104-3",
+      "description": "Given the elicited rate-limit-zone-id is empty at apply, when the runner attempts a runOnce, the runner refuses with outcome:\"error\" reason:\"zone-id-missing\" on exactly one audit event, no live API call is issued, and no false no-drift result is written.",
+      "given": "the fake-fetch harness with rate-limit-zone-id set to empty string",
+      "when": "the runner attempts runOnce",
+      "then": "the runner emits one audit event with outcome \"error\" reason \"zone-id-missing\"; no fetch call fires and no no-drift audit is emitted",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3703-edge-cloudflare-rate-limiting-drift-audit-runner",
+        "field": "interfaces.createDriftAuditRunner"
+      }
+    },
+    {
+      "id": "AC-36104-4",
+      "description": "Given the injected fetch returns status 401 or 403 on the Cloudflare API endpoint, when the runner runs runOnce, the runner emits one audit event with outcome:\"error\" reason:\"api-auth\" carrying the upstream status but no token, header or body echo, and no no-drift audit is emitted.",
+      "given": "the fake-fetch harness returning 401 or 403 on GET /client/v4/zones/{zone_id}/rulesets",
+      "when": "the runner runs runOnce",
+      "then": "the runner emits one audit event outcome \"error\" reason \"api-auth\" with the upstream status and no leaked token/header/body",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3703-edge-cloudflare-rate-limiting-drift-audit-runner",
+        "field": "interfaces.createDriftAuditRunner"
+      }
+    },
+    {
+      "id": "AC-36104-5",
+      "description": "Given the injected fetch returns status 429 (Cloudflare API-side rate limit), when the runner runs runOnce, the runner emits one audit event with outcome:\"error\" reason:\"api-throttled\" carrying the Retry-After metadata value only, and no no-drift audit is emitted.",
+      "given": "the fake-fetch harness returning 429 with Retry-After",
+      "when": "the runner runs runOnce",
+      "then": "the runner emits one audit event outcome \"error\" reason \"api-throttled\" carrying only the Retry-After metadata and no no-drift audit",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3703-edge-cloudflare-rate-limiting-drift-audit-runner",
+        "field": "interfaces.createDriftAuditRunner"
+      }
+    },
+    {
+      "id": "AC-36104-6",
+      "description": "Given the injected fetch resolves with status 200 but the body is not valid JSON, or the JSON body omits the expected result field, when the runner parses the response, the runner emits one audit event with outcome:\"error\" reason:\"api-malformed\" and no no-drift audit is emitted.",
+      "given": "the fake-fetch harness returning 200 with an unparseable body or a missing result field",
+      "when": "the runner parses the response",
+      "then": "the runner emits one audit event outcome \"error\" reason \"api-malformed\" and never emits a no-drift audit",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3703-edge-cloudflare-rate-limiting-drift-audit-runner",
+        "field": "interfaces.createDriftAuditRunner"
+      }
+    },
+    {
+      "id": "AC-36104-7",
+      "description": "Given the injected fetch never resolves within the bounded timeout, when the runner runs runOnce, the runner aborts and emits one audit event with outcome:\"error\" reason:\"api-timeout\" and no no-drift audit is emitted.",
+      "given": "the fake-fetch harness that never resolves",
+      "when": "the runner runs runOnce within the bounded timeout window",
+      "then": "the runner aborts and emits one audit event outcome \"error\" reason \"api-timeout\"",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3703-edge-cloudflare-rate-limiting-drift-audit-runner",
+        "field": "interfaces.createDriftAuditRunner"
+      }
     }
   ],
   "tacIds": [
     "TAC-3703-edge-cloudflare-rate-limiting-drift-audit-runner"
   ],
   "createdAt": "2026-09-07T22:00:00.000Z",
-  "updatedAt": "2026-09-07T22:00:00.000Z"
+  "updatedAt": "2026-09-09T12:00:00.000Z"
 }

package/blueprints/edge-cloudflare-rate-limiting/contributions/user-stories/edge-cloudflare-rate-limiting-us-36105.json

@@ -11,17 +11,19 @@
   "acceptanceCriteria": [
     {
       "id": "AC-36105-1",
-      "description": "The guide contains a section titled Composition with security-auth-magic-link that names ADR-3702 explicitly, states the zone rule characteristic (IP-per-URL) and the application rule characteristic (per-email per-minute) verbatim, and shows a copy-paste example of both blueprints applied on the same project.",
+      "description": "The guide contains a section titled Composition with security-auth-magic-link that names ADR-3702 explicitly, states the zone rule characteristic (IP-per-URL) and the application rule characteristic (per-email per-minute) verbatim, and shows a copy-paste example of both blueprints applied on the same project. Per section 7a, this AC is legal as the single AC on the story because the guide and the anchored TAC name no additional documented failure path for this mechanism (adjacent failure paths are owned by sibling stories on the same blueprint, not by this one).",
       "given": "the shipped guide at blueprints/edge-cloudflare-rate-limiting/guide/edge-cloudflare-rate-limiting.md",
       "when": "the anatomy test scans the guide for the composition section and ADR-3702 reference",
       "then": "the section heading, ADR-3702 reference, both characteristic strings and the copy-paste example are present",
       "testable": true,
-      "scope": "documentation"
+      "scope": "documentation",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [
     "TAC-3702-edge-cloudflare-rate-limiting-management-surface-doc"
   ],
   "createdAt": "2026-09-07T22:00:00.000Z",
-  "updatedAt": "2026-09-07T22:00:00.000Z"
+  "updatedAt": "2026-09-10T00:00:00.000Z",
+  "description": "Story owns the guide-section presence assertion for the security-auth-magic-link composition documentation. Per section 7a, this story carries a single AC because the guide names no runtime failure path for this guide-section-presence mechanism."
 }

package/blueprints/edge-cloudflare-rate-limiting/contributions/user-stories/edge-cloudflare-rate-limiting-us-36106.json

@@ -11,17 +11,36 @@
   "acceptanceCriteria": [
     {
       "id": "AC-36106-1",
-      "description": "Given the shipped rate-limit-rule JSON Schema (blueprints/edge-cloudflare-rate-limiting/contributions/schemas/rate-limit-rule.schema.json, draft-07), the manifest-schema-validate probe reads every manifest file in the fixture manifest directory and validates each against the schema; every valid file passes; a manifest file with a missing threshold field (simulated via SIMULATE_SCHEMA_INVALID=true) fails validation and the probe returns aggregateVerdict: fail with the offending field named in the detail.",
+      "description": "Given the shipped rate-limit-rule JSON Schema (blueprints/edge-cloudflare-rate-limiting/contributions/schemas/rate-limit-rule.schema.json, draft-07) and the canonical cf-edge fixture manifest directory, when the manifest-schema-validate probe reads every manifest file and validates each against the schema, every file passes and the probe returns aggregateVerdict:pass.",
       "given": "the cf-edge fixture with the two committed manifest files and the shipped JSON Schema",
       "when": "the manifest-schema-validate probe validates every manifest file",
       "then": "every valid file passes; the SIMULATE_SCHEMA_INVALID=true switch surfaces the missing threshold field and the aggregate verdict is fail",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3701-edge-cloudflare-rate-limiting-manifest-schema",
+        "field": "interfaces.rate-limit-rule"
+      }
+    },
+    {
+      "id": "AC-36106-2",
+      "description": "Given a fixture manifest file with a missing threshold field, injected via the SIMULATE_SCHEMA_INVALID=true switch, when manifest-schema-validate runs, the probe returns aggregateVerdict:fail with detail naming the offending field.",
+      "given": "the fixture cf-edge manifest with the threshold field removed on one rule (SIMULATE_SCHEMA_INVALID=true)",
+      "when": "manifest-schema-validate runs against the mutated fixture",
+      "then": "the probe returns aggregateVerdict:fail with detail naming the missing `threshold` field",
+      "testable": true,
+      "scope": "library",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3701-edge-cloudflare-rate-limiting-manifest-schema",
+        "field": "interfaces.rate-limit-rule"
+      }
     }
   ],
   "tacIds": [
     "TAC-3701-edge-cloudflare-rate-limiting-manifest-schema"
   ],
   "createdAt": "2026-09-07T22:00:00.000Z",
-  "updatedAt": "2026-09-07T22:00:00.000Z"
+  "updatedAt": "2026-09-09T13:00:00.000Z"
 }

package/blueprints/edge-cloudflare-rate-limiting/contributions/user-stories/edge-cloudflare-rate-limiting-us-36107.json

@@ -4,24 +4,35 @@
   "reqId": "edge-cloudflare-rate-limiting-REQ-004",
   "version": "1.0.0",
   "status": "approved",
-  "title": "Drift-audit records carry metadata-only fields (ruleId, clientIpHash, outcome, timestamp) with no full IP, no body, no user agent",
+  "title": "Drift-audit and request-event records follow the metadata-only shapes declared on TAC-3703-edge-cloudflare-rate-limiting-drift-audit-runner.purpose (drift records omit clientIpHash; request-event records carry a hashed prefix only)",
   "asA": "operator on the applying project reading drift-audit reports and rate-limit event records through the applied logging companion",
-  "iWant": "every drift-audit record and every rate-limit event record to carry only metadata-safe fields (ruleId, clientIpHash, outcome, timestamp, plus the drift diff fields where applicable), never a full client IP, never a request body, never a user agent string",
+  "iWant": "the drift-audit runner and the runtime request-event path to emit records shaped exactly as TAC-3703-edge-cloudflare-rate-limiting-drift-audit-runner.purpose declares; both classes never carry a full client IP, never a request body, never a user agent",
   "soThat": "the audit trail is safe to store, forward and read without additional PII scrubbing at the audit sink",
   "acceptanceCriteria": [
     {
       "id": "AC-36107-1",
-      "description": "The event-secrecy probe drives a synthetic drift-audit payload constructed from a fixture rule and a fake live-zone response; every record on the sink carries only {ruleId, clientIpHash, outcome, timestamp} plus (for drift records) a diff array with the schema-safe fields; the probe asserts NO full IP (regex 4-octet dotted quad or v6 group), NO request body key, NO user-agent key; the SIMULATE_EVENT_LEAK_IP=true switch injects a full IP into the drift record and the probe returns aggregateVerdict: fail with the leaked key named in the detail.",
+      "description": "Given a synthetic drift-audit payload constructed from a fixture rule and a fake live-zone response, and a separate runtime request-event synthetic payload, when the event-secrecy probe reads the sink, every drift-audit record carries only {ruleId, outcome, timestamp, diff} (never clientIpHash, never a full IP as regex 4-octet dotted quad or v6 group, never a request-body key, never a user-agent key), and every request-event record carries only {ruleId, clientIpHash, outcome, timestamp} where clientIpHash is a bounded hashed prefix (32 hex chars max, never a full IP); the probe returns aggregateVerdict:pass.",
       "given": "the shipped drift-audit runner and a synthetic input pair",
       "when": "the event-secrecy probe drives the runner and inspects the resulting records",
       "then": "every record carries only the metadata-safe fields; SIMULATE_EVENT_LEAK_IP=true surfaces a leaked key and the aggregate verdict is fail",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-36107-2",
+      "description": "Given the SIMULATE_EVENT_LEAK_IP=true switch, a full IP is injected into a record produced by the runner, when the event-secrecy probe reads the sink, the probe returns aggregateVerdict:fail with detail naming the leaked key.",
+      "given": "the drift-audit runner producing records under SIMULATE_EVENT_LEAK_IP=true (a full IP injected into one record)",
+      "when": "the event-secrecy probe scans the sink",
+      "then": "the probe returns aggregateVerdict:fail with detail naming the leaked key",
+      "testable": true,
+      "scope": "library",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [
     "TAC-3703-edge-cloudflare-rate-limiting-drift-audit-runner"
   ],
   "createdAt": "2026-09-07T22:00:00.000Z",
-  "updatedAt": "2026-09-07T22:00:00.000Z"
+  "updatedAt": "2026-09-10T00:00:00.000Z"
 }

package/blueprints/edge-cloudflare-rate-limiting/contributions/user-stories/edge-cloudflare-rate-limiting-us-36108.json

@@ -11,17 +11,28 @@
   "acceptanceCriteria": [
     {
       "id": "AC-36108-1",
-      "description": "Given the cf-edge fixture with the SIMULATE_MANIFEST_MISSING=true switch, one committed manifest file is treated as absent by the probe; the manifest-presence probe returns aggregateVerdict: fail with the missing file's basename named in the detail; without the switch the probe passes and both manifest files are inspected.",
+      "description": "Given the canonical cf-edge fixture with every committed manifest file present, when the manifest-presence probe walks the fixture manifest directory, both fixture files are inspected and the probe returns aggregateVerdict:pass.",
       "given": "the cf-edge fixture with two committed manifest files and the SIMULATE_MANIFEST_MISSING=true switch",
       "when": "the manifest-presence probe scans the fixture manifest directory",
       "then": "the probe returns aggregateVerdict: fail and the missing file basename is present in the detail",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-36108-2",
+      "description": "Given the cf-edge fixture with the SIMULATE_MANIFEST_MISSING=true switch (one committed manifest file is treated as absent by the probe), when manifest-presence runs, the probe returns aggregateVerdict:fail with detail naming the missing file's basename.",
+      "given": "the cf-edge fixture with SIMULATE_MANIFEST_MISSING=true (one committed manifest file treated as absent)",
+      "when": "the manifest-presence probe runs",
+      "then": "the probe returns aggregateVerdict:fail with detail naming the missing file's basename",
+      "testable": true,
+      "scope": "library",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [
     "TAC-3701-edge-cloudflare-rate-limiting-manifest-schema"
   ],
   "createdAt": "2026-09-07T22:00:00.000Z",
-  "updatedAt": "2026-09-07T22:00:00.000Z"
+  "updatedAt": "2026-09-09T13:00:00.000Z"
 }

package/blueprints/edge-cloudflare-rate-limiting/docs/topics.md

@@ -59,7 +59,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
 | edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
 
-US 36101-36108 sit at the LOW end of the 36101-36899 band on purpose (watchpost run-4 lesson). ADR/TAC suffixes for this blueprint use the 3701-3799 block, continuing the shelf pattern.
+US 36101-36108 sit at the LOW end of the 36101-36899 band on purpose. ADR/TAC suffixes for this blueprint use the 3701-3799 block, continuing the shelf pattern.
 
 ## Shared expectations for future composing blueprints
 

package/blueprints/edge-cloudflare-rate-limiting/guide/edge-cloudflare-rate-limiting.md

@@ -1,6 +1,6 @@
 # edge-cloudflare-rate-limiting guide
 
-Round 6 T-6 of the Cloudflare-first blueprint line. Ships zone-level rate limiting as an edge gate in front of Worker handlers. The rule set is a local manifest the applying project commits, and an operator applies it to the live Cloudflare zone through either a wrangler command flow or the Cloudflare dashboard flow, both walked below.
+Ships zone-level rate limiting as an edge gate in front of Worker handlers. The rule set is a local manifest the applying project commits, and an operator applies it to the live Cloudflare zone through either a wrangler command flow or the Cloudflare dashboard flow, both walked below.
 
 ## Manifest
 
@@ -79,7 +79,7 @@ The applied recorder records both blueprints so the operator sees the two-rule s
 
 ## Drift audit
 
-The blueprint ships a scheduled drift-audit runner realisation in the `cf-edge` fixture at `packages/rcf-lite/test/fixtures/cf-edge/src/drift-audit-runner.mjs`. The runner exports `createDriftAuditRunner({env, eventSink, fetch, clock, cadence, manifestLoader})` per TAC-3703 and fetches the live rules on the elicited zone via `https://api.cloudflare.com/client/v4/zones/{zone_id}/rulesets`, diffs field-by-field against the local manifest, and constructs one drift-audit record per mismatched rule with the metadata-only shape `{ruleId, clientIpHash, outcome, timestamp, diff}`. No record carries a full client IP, a request body or a user agent (event-secrecy discipline per REQ-005 and AC-36107-1).
+The blueprint ships a scheduled drift-audit runner realisation in the `cf-edge` fixture at `packages/rcf-lite/test/fixtures/cf-edge/src/drift-audit-runner.mjs`. The runner exports `createDriftAuditRunner({env, eventSink, fetch, clock, cadence, manifestLoader})` per TAC-3703 and fetches the live rules on the elicited zone via `https://api.cloudflare.com/client/v4/zones/{zone_id}/rulesets`, diffs field-by-field against the local manifest, and constructs one drift-audit record per mismatched rule following the metadata-only shape declared on `TAC-3703-edge-cloudflare-rate-limiting-drift-audit-runner.purpose` (drift records omit the runtime-only clientIpHash because drift is manifest-vs-live divergence, not a request event). The separate request-event record class emitted by the applied guard on a real client request follows the request-event shape declared on the same TAC field. No record carries a full client IP, a request body or a user agent (event-secrecy discipline per REQ-005 and AC-36107-1).
 
 The elicited `rate-limit-drift-audit-cadence` per ADR-3704 picks `off` (runner not wired), `daily` (24-hour cadence, `recommendedDefault`), or `hourly`.
 

package/blueprints/edge-cloudflare-tunnel/CHANGELOG.md

@@ -1,23 +1,56 @@
 # edge-cloudflare-tunnel CHANGELOG
 
+## 1.1.3 - 2026-09-10
+
+Positive-evidence rule alignment on the probe pack skip path (authoring standard section 7d); register tidy in shipped prose (no capability change).
+
+- Probes and fixture: extended the shared `accountBoundSkippedResult` helper in `contributions/probes/probe-utils.mjs` to carry a `reason` field naming the exact env var(s) that were unset on the skip return; added a "Declared env vars" section for the tunnel probes to the shared fixture README (`packages/rcf-lite/test/fixtures/hetzner-throwaway-server/README.md`), per authoring standard section 7d.
+- Probe report detail hygiene: `accountBoundSkippedResult` now names only the actually-unset variables in its `detail` string (a partial skip with one first-tier gate set and the other unset reads honestly, instead of claiming the whole input list is unset). The `reason` field was already exact; this aligns the human-readable detail with it.
+- README now leads with a category-neutral opening line.
+
+## 1.1.2 - 2026-09-10
+
+Capability token named in the requirements layer.
+
+- Extended REQ-001 description to name the declared `tunnelBridge` capability token verbatim with a one-line runtime clause tying the token to the connector shape that supplies it.
+- Added AC-tunnel-capabilityToken on US-39101 as a fixed AC that binds the manifest-declared `tunnelBridge` token to the on-disk connector variant selected by the applied capability set.
+
+## 1.1.1 (register-sweep patch, 2026-09-10)
+
+- Register: neutral wording in shipped prose (no capability change).
+
+## 1.1.0 - 2026-09-09
+
+Adds REQ-layer backing for zone resolution and hostname expansion, and extends the AC set to cover every documented failure path.
+- Added REQ-006 (zone resolution via the vault seam; AUD-mandatory-when-gated) and REQ-007 (public-hostname template expansion at apply with malformed and duplicate refusals). Neither elicit or capability token was removed; both are now backed by a `must`-priority requirement.
+- Added TAC-4004-edge-cloudflare-tunnel-zone-and-hostname-apply naming the apply-time responsibilities for zone resolution, hostname expansion and AUD-mandatory refusals.
+- Added user stories US-39109 (four apply-time ACs across the zone-resolution and AUD-mandatory-when-gated paths) and US-39110 (three apply-time ACs across the hostname-template expansion, malformed and duplicate paths).
+- Added the following failure-path ACs to existing stories: AC-tunnel-cloudflaredReady on US-39102 (boot event observation; closes F-4 event-name inconsistency by naming both `cloudflaredReady` (process boot) and `tunnelConnectorUp` (per-connector) as distinct events); AC-tunnel-connectorPrecedence on US-39101 (four-combination precedence with two apply-refusal codes; closes F-5); four `AC-tunnel-accessGatedReject*/Accept*` ACs on US-39106 covering missing, invalid and wrong-audience JWT paths plus the valid-audience accept path (closes F-6); AC-tunnel-credentialsHostMode and AC-tunnel-credentialsTrackedTreeScan on US-39108 (closes F-7).
+- Every REQ now carries `deliveredBy` into the owning TAC or ADR; every AC carries `disposition` (`fixed` or `template`); ACs referencing owner-owned literals carry `ownerRef`. Vendor citations added where an AC rests on a mechanism-invariant vendor fact.
+- Tightened the `access-aud` elicit prompt: when `zeroTrustGate` is applied the value is mandatory (apply refuses with `apply.tunnel-aud-missing`); when absent, the tunnel serves in the deliberate public-hostname mode per ADR-4003 (closes specimen F-3).
+- Guide updated in the "Hostname mode: when to reach for Access-gated vs public-hostname" section to name the AUD-mandatory-when-gated rule; the earlier "Graceful degrade" wording is retired.
+- De-identified operator-internal names across the blueprint (operator-internal path prefixes renamed to `vault/*`; other in-house references neutralised) to keep the shipped package customer-facing.
+- Chain-consistency lint (`rcf define blueprint lint-consistency`) reports 0 findings on both passes for this blueprint.
+- Split every bundled single-AC story on a per-failure-path basis so each named path (SIMULATE_MANIFEST_INVALID_TUNNEL_ID / _CREDENTIALS_INLINE / _MISSING_CATCHALL on US-39103; SIMULATE_INGRESS_INVALID on US-39104 with the happy path split off; SIMULATE_ORIGIN_PORT_OPEN on US-39105 with the happy path split off; SIMULATE_AUD_DROP on US-39107 with the happy path split off) is its own AC on the owning story with a concrete oracle (probe verdict + named field) and an `ownerRef` into the owning TAC. Vendor citations added on the US-39106 four AUD ACs (Cloudflare Access self-hosted-public-app-owned literals) and on the vendor cloudflared local-configuration-file reference (US-39104); the four US-39106 AUD ACs and AC-tunnel-hostnameTemplateExpand on US-39110 marked `template` naming the values the applying agent sets (elicited access-aud tag; ingress rule service names and resolved zone). Filled `ownerRef` and given/when/then on AC-tunnel-connectorShape (US-39101). Filled given/when/then on AC-tunnel-accessGated (US-39106). Reworded the US-39102 title and `iWant` to name both `cloudflaredReady` (boot) and `tunnelConnectorUp` (per-connector) as distinct events. Added `## Zone resolution` and `## Public-hostname template expansion` sections to the shipped guide.
+
+
 ## 1.0.1 - 2026-09-08
 
-H-2 hardening train (`h2-cf-platform-probe-integrity`): probe-integrity patch. No capability change.
+Probe-integrity patch. No capability change.
 
-- Replaced the warn-on-env-set stub in `real-account-connector-healthy.mjs` with a real cloudflared connector-health driver via the new cf-edge shim (`packages/rcf-lite/test/fixtures/cf-edge/h2-cf-tunnel-shim.mjs`). With both `CI_HAS_CLOUDFLARE_ACCOUNT` and `CI_HAS_HETZNER_ACCOUNT` set, the driver provisions the throwaway server through the hetzner fixture surface (H-1 territory, consumed as-is), runs `cloudflared tunnel info <name>` via the shim, asserts healthy connector count, captures the `tunnelConnectorUp` event, and always tears the server down. Env-absent branch keeps pass-with-skip. Env-present-with-fixture-failure yields FAIL with a pointer to the fixture step, never warn.
+- Replaced the warn-on-env-set stub in `real-account-connector-healthy.mjs` with a real cloudflared connector-health driver via the new cf-edge shim (`packages/rcf-lite/test/fixtures/cf-edge/h2-cf-tunnel-shim.mjs`). With both `CI_HAS_CLOUDFLARE_ACCOUNT` and `CI_HAS_HETZNER_ACCOUNT` set, the driver provisions the throwaway server through the hetzner fixture surface (consumed as-is), runs `cloudflared tunnel info <name>` via the shim, asserts healthy connector count, captures the `tunnelConnectorUp` event, and always tears the server down. Env-absent branch keeps pass-with-skip. Env-present-with-fixture-failure yields FAIL with a pointer to the fixture step, never warn.
 - Replaced both warn-on-env-set stubs in `real-account-tunnel-hostname-routes.mjs` with real drivers. Public-hostname sub-case: undici fetch against the scratch subdomain via the shim's `fetchTunnelHostname` seam, activated on `CI_HAS_CLOUDFLARE_ACCOUNT`. Access-gated sub-case: two-identity HS256 JWT check, activated only when `CI_HAS_CLOUDFLARE_ACCESS` is ALSO set (amendment 4). Env-absent branch keeps pass-with-skip. A pass is no longer reachable from `CI_HAS_CLOUDFLARE_ACCOUNT` presence alone.
 - Converted the credentials-placeholder-read-failed branch in `manifest-schema-validate.mjs::eventSecrecyScan` from warn to fail with a pointer to the exact fixture path (`packages/rcf-lite/test/fixtures/hetzner-throwaway-server/cloudflared/*/credentials/probe.json.example`) and the setup requirement (must exist and parse as JSON).
 - Added the cf-edge tunnel shim (`packages/rcf-lite/test/fixtures/cf-edge/h2-cf-tunnel-shim.mjs`) with five seams: `provisionScratchServer`, `destroyScratchServer`, `cloudflaredTunnelInfo`, `fetchTunnelHostname`, `mintScratchIdentity`. The shim reads `H2_CF_TUNNEL_SHIM_MODE` and `H2_CF_TUNNEL_HOSTNAME_SHIM_MODE` for synthetic-mode branches; the probe bodies hold zero `SIMULATE_` token references.
-- Tunnel symbolic-anchor ruling (task C4): the `AC-tunnel-*` symbolic ids on the five tunnel probes ARE the shipped AC ids in the `US-39101..US-39108` contribution band, so no re-anchor was performed. Full mapping in the H-2 PR body.
+- The `AC-tunnel-*` symbolic ids on the five tunnel probes ARE the shipped AC ids in the `US-39101..US-39108` contribution band, so no re-anchor is performed by this patch.
 
 ## 1.0.0 - 2026-09-08
 
-Initial release. Round-7 T-3 of the Hetzner spec at `projects/blueprint-library/specs/hetzner-round-7-spec-2026-09-07.md`.
+Initial release. Round-7 blueprint of the Hetzner spec at `projects/blueprint-library/specs/hetzner-round-7-spec-2026-09-07.md`.
 
 - Mints capability `tunnelBridge` and global topic `edgeIngressBridge`.
 - Five REQs, eight USs, three TACs, three ADRs; five Node-only probes.
-- Extends the shared throwaway-Hetzner-server fixture with a cloudflared connector in both runtime shapes (compose-service alongside the T-2 web and caddy services when `containerHost` is applied; systemd-unit for a bare `cloudHost`) and both hostname modes (access-gated when `zeroTrustGate` is applied; public-hostname when absent) plus five `run-<probe>.mjs` delegate shims.
+- Extends the shared throwaway-Hetzner-server fixture with a cloudflared connector in both runtime shapes (compose-service alongside the compose-host web and caddy services when `containerHost` is applied; systemd-unit for a bare `cloudHost`) and both hostname modes (access-gated when `zeroTrustGate` is applied; public-hostname when absent) plus five `run-<probe>.mjs` delegate shims.
 - manifest-schema-validate carries five fixture-side mutation switches (`SIMULATE_MANIFEST_INVALID_TUNNEL_ID`, `SIMULATE_MANIFEST_CREDENTIALS_INLINE`, `SIMULATE_MANIFEST_MISSING_CATCHALL`, `SIMULATE_ORIGIN_PORT_OPEN`, `SIMULATE_EVENT_SECRECY_LEAK`); cloudflared-config-lint carries `SIMULATE_INGRESS_INVALID` and runs `cloudflared tunnel ingress validate` via the `cloudflare/cloudflared:2026.8.3` container when a local binary is not on PATH; aud-presence-check carries `SIMULATE_AUD_DROP`.
-- Mutation-discipline (T-2 gate ruling carried forward): every `SIMULATE_*` switch lives in the fixture-side delegate shim; the probe modules read only `RCF_LITE_T3_FIXTURE_ROOT` and never branch on being under mutation.
+- Mutation-discipline (real-account gate ruling carried forward): every `SIMULATE_*` switch lives in the fixture-side delegate shim; the probe modules read only `RCF_LITE_T3_FIXTURE_ROOT` and never branch on being under mutation.
 - Connector-runtime choice elicited via `connector-runtime` (compose-service default when `containerHost` applied; systemd-unit alternative for bare `cloudHost`, per the vendor cloudflared as-a-service local-configuration-file docs); hostname-mode discovered (not elicited) from `appliedCapabilities` via the sidecar per ADR-4003.
-- Consumers: `w-2026-09-06-dave-010` follow-on (make the librarian API and workspace viewer reachable without Mullvad) is the estate consumer; blueprint acceptance never depends on that consumer, and the ops-01 migration mints as its own work item.

package/blueprints/edge-cloudflare-tunnel/README.md

@@ -1,6 +1,6 @@
 # edge-cloudflare-tunnel
 
-Round-7 T-3 core blueprint on the rcf-lite shelf. Bridges a service on a
+Core blueprint on the rcf-lite shelf. Bridges a service on a
 `cloudHost` (bare, systemd shape) or a `containerHost` (compose-service
 shape) to the Cloudflare edge through a Cloudflare Tunnel, with no
 public origin ports. When applied alongside `edge-cloudflare-access`
@@ -13,7 +13,6 @@ when applied without it the tunnel serves in public-hostname mode.
 - Capabilities: `["tunnelBridge"]`
 - Mints global topic: `edgeIngressBridge`
 - Contribution count: 5 REQs, 8 USs, 3 TACs, 3 ADRs, 5 probes
-- Consumers: ops-01 has no consumer today (SSH is the only inbound path). Estate consumer is the follow-on make-the-librarian-API-and-workspace-viewer-reachable-without-Mullvad work that `w-2026-09-06-dave-010` is expected to green-light. Blueprint acceptance never depends on that consumer; the ops-01 migration mints as a separate work item at that point (`w-2026-09-07-dave-004`).
 
 ## Five REQs
 
@@ -21,7 +20,7 @@ when applied without it the tunnel serves in public-hostname mode.
 |---|---|
 | edge-cloudflare-tunnel-REQ-001 | Connector install shape switches on applied `containerHost` (compose-service default; systemd-unit for bare `cloudHost`); `cloudflaredReady` fires on boot with connector id, region and version metadata. |
 | edge-cloudflare-tunnel-REQ-002 | Tunnel manifest schema at `cloudflare/tunnels/<name>.yaml` (uuid tunnel id, `credentialsFile.secretRef` reference, ingress rules with catch-all `http_status:404`). |
-| edge-cloudflare-tunnel-REQ-003 | No public origin ports on the host; T-1 firewall stays closed on 80/443 unless a reverse proxy is applied; manifest refuses ingress rules whose service URL binds to a host public interface. |
+| edge-cloudflare-tunnel-REQ-003 | No public origin ports on the host; the deploy-hetzner-server firewall stays closed on 80/443 unless a reverse proxy is applied; manifest refuses ingress rules whose service URL binds to a host public interface. |
 | edge-cloudflare-tunnel-REQ-004 | Access-gated composition: `zeroTrustGate` applied attaches `originRequest.access.aud`; absent omits the block and serves in public-hostname mode. |
 | edge-cloudflare-tunnel-REQ-005 | Credentials-file discipline (host mode 0o400, referenced via `secretRef`, not committed, grep-refuse, no leak in event bodies). |
 
@@ -33,7 +32,7 @@ The connector runtime is elicited via `connector-runtime` (ADR-4002) with
 - **compose-service** (default when `containerHost` is applied). The
   cloudflared container ships alongside the applying project services on
   the same web-net network. No host ports; restart `unless-stopped`;
-  logging driver aligned with the T-2 compose-host log-driver elicit.
+  logging driver aligned with the platform-docker-compose-host log-driver elicit.
   Fixture: `packages/rcf-lite/test/fixtures/hetzner-throwaway-server/cloudflared/compose-service/`.
 - **systemd-unit** (alternative for a bare `cloudHost`). The cloudflared
   binary is installed via the vendor package per the cloudflared
@@ -66,7 +65,7 @@ Example (compose-service, public-hostname mode):
 ```yaml
 tunnel: 00000000-0000-4000-8000-0000000012ab
 credentialsFile:
-  secretRef: hq-estate/CLOUDFLARE_TUNNEL_CREDENTIALS_MY_PROJECT
+  secretRef: vault/CLOUDFLARE_TUNNEL_CREDENTIALS_MY_PROJECT
 ingress:
   - hostname: my-app.example.com
     service: http://web:8080
@@ -121,17 +120,17 @@ elicited; see ADR-4003). The blueprint reads the sidecar at
 The `aud-presence-check` probe refuses when the gated variant drifts to
 omit the AUD block (defensive against silent degradation).
 
-Graceful degrade: when Access is not applied (T-4 absent from
+Graceful degrade: when Access is not applied (the `zeroTrustGate` capability is absent from
 `origin/main` or the applying project simply does not want the gate),
 the blueprint still ships in public-hostname mode. The probe assertion
 runs on both fixture variants so the shape flip is proven on every
-reviewer boot.
-
+operator boot.
 ## No-public-ports rule
 
-The T-1 firewall on a `cloudHost` allows 22 unconditionally and 80/443
-only when a reverse proxy is applied. A project applying only T-1 plus
-T-3 (no reverse proxy) declares zero 80/443 rules; the tunnel is the
+The deploy-hetzner-server firewall on a `cloudHost` allows 22 unconditionally and 80/443
+only when a reverse proxy is applied. A project applying only
+deploy-hetzner-server and edge-cloudflare-tunnel (no reverse proxy)
+declares zero 80/443 rules; the tunnel is the
 sole path from the edge to the origin. The manifest schema refuses
 ingress rules whose service URL binds to `0.0.0.0`, a non-loopback
 numeric IP, or an unresolvable shape.
@@ -140,7 +139,7 @@ numeric IP, or an unresolvable shape.
 
 - `tunnel-name` (string; default `probe`): the Cloudflare Tunnel name
   and the manifest filename under `cloudflare/tunnels/<name>.yaml`.
-- `cloudflare-zone-secret` (string; default `hq-estate/CLOUDFLARE_ZONE_ID`):
+  `security-secrets-management` reference to the Cloudflare zone the
   `security-secrets-management` reference to the Cloudflare zone the
   tunnel serves under.
 - `public-hostname-template` (string; default `<service>.<zone>`):
@@ -150,14 +149,14 @@ numeric IP, or an unresolvable shape.
 - `access-aud` (string; default empty): Access AUD tag for the gated
   shape. Presence toggles the gated shape when `zeroTrustGate` is
   applied.
-- `connector-runtime` (enum: `compose-service`, `systemd-unit`; default
+  `compose-service`): the connector runtime per ADR-4002.
   `compose-service`): the connector runtime per ADR-4002.
 
 ## Companions
 
-- `suggestedCompanions[logging]`: every `cloudflaredReady`,
   `tunnelConnectorUp`, `tunnelConnectorDown`, `ingressRuleReloaded` and
   `accessGateRefused` event writes through the applied logger.
+  `accessGateRefused` event writes through the applied logger.
 - `suggestedCompanions[errorHandling]`: a cloudflared exit, a JWT-check
   failure, an ingress-rule schema violation, a hostname-DNS-route API
   refusal constructs an internal error record.
@@ -173,28 +172,27 @@ under the repo root.
 - **manifest-schema-validate** (local). Anchors AC-tunnel-manifestSchema,
   AC-tunnel-noPublicOrigin, AC-tunnel-credentialsDiscipline. `accountBound: false`.
   Ajv-free walker over the shipped JSON schema; runs on all four
-  variants; refuses on `SIMULATE_MANIFEST_INVALID_TUNNEL_ID`,
   `SIMULATE_MANIFEST_CREDENTIALS_INLINE`, `SIMULATE_MANIFEST_MISSING_CATCHALL`,
   `SIMULATE_ORIGIN_PORT_OPEN`, `SIMULATE_EVENT_SECRECY_LEAK`.
-- **cloudflared-config-lint** (local). Anchors AC-tunnel-hostnameRoutes.
+  `SIMULATE_ORIGIN_PORT_OPEN`, `SIMULATE_EVENT_SECRECY_LEAK`.
   `accountBound: false`. Runs `cloudflared tunnel --config <path> ingress validate`
-  via a local binary or the vendor container image
+  `accountBound: false`. Runs `cloudflared tunnel --config <path> ingress validate`
+  `cloudflare/cloudflared:2026.8.3`; refuses on `SIMULATE_INGRESS_INVALID`.
   `cloudflare/cloudflared:2026.8.3`; refuses on `SIMULATE_INGRESS_INVALID`.
 - **aud-presence-check** (local). Anchors AC-tunnel-accessGated,
   AC-tunnel-accessGatedRefuse. `accountBound: false`. Reads the sidecar
   and the paired manifests; asserts the shape flips correctly; refuses
   on `SIMULATE_AUD_DROP` when the gated fixture drifts to open ingress.
 - **real-account-connector-healthy** (account-bound). Anchors
-  AC-tunnel-connectorHealthy. `accountBound: true` on
   `CI_HAS_CLOUDFLARE_ACCOUNT` AND `CI_HAS_HETZNER_ACCOUNT`. Without
-  both, records `accountBoundSkipped: true` and the aggregate flips to
+  `CI_HAS_CLOUDFLARE_ACCOUNT` AND `CI_HAS_HETZNER_ACCOUNT`. Without
+  `pass`.
   `pass`.
 - **real-account-tunnel-hostname-routes** (account-bound). Anchors
   AC-tunnel-hostnameRoutes (public sub-case) and AC-tunnel-accessGated
   (gated sub-case). `accountBound: true`. The public-hostname sub-case
   runs on `CI_HAS_CLOUDFLARE_ACCOUNT` + `CI_HAS_HETZNER_ACCOUNT`; the
-  access-gated sub-case adds `CI_HAS_CLOUDFLARE_ACCESS` per the round-7
-  Q4 ratification. Sub-cases skip independently.
+  access-gated sub-case adds `CI_HAS_CLOUDFLARE_ACCESS`. Sub-cases skip independently.
 
 The delegate shims at
 `packages/rcf-lite/test/fixtures/hetzner-throwaway-server/run-<probe>.mjs`
@@ -208,7 +206,7 @@ The fixture lives under
 `packages/rcf-lite/test/fixtures/hetzner-throwaway-server/cloudflared/`:
 
 - `compose-service/compose-fragment.yaml`: the cloudflared compose
-  service alongside the T-2 web and caddy services.
+  service alongside the compose-host web and caddy services.
 - `systemd-unit/cloudflared.service`: the systemd unit per the vendor
   as-a-service docs.
 - `<runtime>/cloudflare/tunnels/public-hostname.yaml`: manifest without
@@ -217,7 +215,7 @@ The fixture lives under
   AUD block on every non-catch-all rule.
 - `<runtime>/credentials/probe.json.example`: placeholder credentials
   documenting the 0o400 mode discipline.
-- `sidecars/access-gated.applied.json`: `appliedCapabilities` includes
+  `zeroTrustGate`.
   `zeroTrustGate`.
 - `sidecars/public-hostname.applied.json`: `appliedCapabilities`
   excludes `zeroTrustGate`.

package/blueprints/edge-cloudflare-tunnel/blueprint.json

@@ -1,6 +1,6 @@
 {
   "slug": "edge-cloudflare-tunnel",
-  "version": "1.0.1",
+  "version": "1.1.3",
   "category": "edge",
   "capabilities": [
     "tunnelBridge"
@@ -26,7 +26,7 @@
       "id": "cloudflare-zone-secret",
       "prompt": "security-secrets-management reference to the Cloudflare zone the tunnel serves under. Read at apply time to create the DNS route; never inlined into the manifest.",
       "kind": "string",
-      "default": "hq-estate/CLOUDFLARE_ZONE_ID"
+      "default": "vault/CLOUDFLARE_ZONE_ID"
     },
     {
       "id": "public-hostname-template",
@@ -42,13 +42,13 @@
     },
     {
       "id": "access-aud",
-      "prompt": "Optional Access AUD tag for the Access-gated shape. When present AND edge-cloudflare-access is applied (zeroTrustGate on appliedCapabilities), every ingress rule attaches originRequest.access.aud with this value. When absent OR edge-cloudflare-access is not applied, the block is omitted and the tunnel serves in public-hostname mode.",
+      "prompt": "Access AUD tag. When edge-cloudflare-access is applied (zeroTrustGate on appliedCapabilities) this value is MANDATORY: every ingress rule attaches originRequest.access.aud with it and cloudflared refuses any request without a valid Access JWT for that AUD. Apply refuses with code apply.tunnel-aud-missing if zeroTrustGate is applied and this value is blank. When edge-cloudflare-access is NOT applied the block is omitted and the tunnel serves in the deliberate public-hostname mode per ADR-4003.",
       "kind": "string",
       "default": ""
     },
     {
       "id": "connector-runtime",
-      "prompt": "Connector runtime per ADR-4002. compose-service is the shipped default when containerHost is applied (T-2 platform-docker-compose-host on top of T-1 deploy-hetzner-server); systemd-unit is the alternative for a bare cloudHost per the cloudflared as-a-service local-configuration-file docs.",
+      "prompt": "Connector runtime per ADR-4002. compose-service is the shipped default when containerHost is applied (via platform-docker-compose-host on top of deploy-hetzner-server); systemd-unit is the alternative for a bare cloudHost per the cloudflared as-a-service local-configuration-file docs.",
       "kind": "enum",
       "options": [
         "compose-service",
@@ -163,6 +163,31 @@
       "recommendedDefault": true,
       "elicited": false,
       "standardsTraceClause": "Cloudflare Access self-hosted-public-app documented shape per hetzner-round-7-spec-2026-09-07.md"
+    },
+    {
+      "id": "edge-cloudflare-tunnel-REQ-006",
+      "kind": "req",
+      "path": "requirements/edge-cloudflare-tunnel-req-006.json"
+    },
+    {
+      "id": "edge-cloudflare-tunnel-REQ-007",
+      "kind": "req",
+      "path": "requirements/edge-cloudflare-tunnel-req-007.json"
+    },
+    {
+      "id": "edge-cloudflare-tunnel-US-39109",
+      "kind": "us",
+      "path": "user-stories/edge-cloudflare-tunnel-us-39109.json"
+    },
+    {
+      "id": "edge-cloudflare-tunnel-US-39110",
+      "kind": "us",
+      "path": "user-stories/edge-cloudflare-tunnel-us-39110.json"
+    },
+    {
+      "id": "TAC-4004-edge-cloudflare-tunnel-zone-and-hostname-apply",
+      "kind": "tac",
+      "path": "tacs/tac-4004-edge-cloudflare-tunnel-zone-and-hostname-apply.json"
     }
   ]
 }

package/blueprints/edge-cloudflare-tunnel/contributions/adrs/adr-4001-edge-cloudflare-tunnel-ingress-bridge-contract.json

@@ -5,13 +5,13 @@
   "version": "1.0.0",
   "status": "accepted",
   "title": "Edge ingress bridge contract: Cloudflare Tunnel as the shipped ingress-bridge shape from a cloudHost service to the CF edge (scope global, new topic edgeIngressBridge)",
-  "context": "An applying project running on a Linux cloudHost needs one shipped answer to the question of how a service on that host reaches the public internet without opening origin ports. Round-7 T-3 mints the edgeIngressBridge topic on this ADR. Cloudflare Tunnel is the shipped v1.0.0 mechanism (cloudflared connector out to the CF edge; DNS route on a Cloudflare zone; ingress rules mapping public hostname to internal service URL). Every applied ingress bridge needs one project-wide answer to the edgeIngressBridge topic; a future non-Cloudflare sibling (Tailscale Funnel, Fly.io proxy) would contribute the same topic string with a different mechanism, forcing a DELIBERATE conflict the operator resolves per the round-2 conflict pattern. Standards trace clause: Cloudflare Tunnel overview and get-started documented mechanics per hetzner-round-7-spec-2026-09-07.md.",
+  "context": "An applying project running on a Linux cloudHost needs one shipped answer to the question of how a service on that host reaches the public internet without opening origin ports. This blueprint mints the edgeIngressBridge topic on this ADR. Cloudflare Tunnel is the shipped v1.0.0 mechanism (cloudflared connector out to the CF edge; DNS route on a Cloudflare zone; ingress rules mapping public hostname to internal service URL). Every applied ingress bridge needs one project-wide answer to the edgeIngressBridge topic; a future non-Cloudflare sibling (Tailscale Funnel, Fly.io proxy) would contribute the same topic string with a different mechanism, forcing a DELIBERATE conflict the operator resolves per the round-2 conflict pattern. Standards trace clause: Cloudflare Tunnel overview and get-started documented mechanics per hetzner-round-7-spec-2026-09-07.md.",
   "decision": "The shipped v1.0.0 default is a Cloudflare Tunnel connector as the edgeIngressBridge provider. A cloudflared connector on the applying host (compose service by default when containerHost is applied per ADR-4002; systemd unit on a bare cloudHost) reads a tunnel manifest at cloudflare/tunnels/<name>.yaml and terminates ingress at the CF edge. The edgeIngressBridge topic scope is global on this blueprint; the topic string is edgeIngressBridge (lower camelCase, one concept per topic, no version suffix, per the round-2 rules-for-new-topics clause on the shelf registry). Standards trace clause: Cloudflare Tunnel overview and get-started documented mechanics per hetzner-round-7-spec-2026-09-07.md.",
-  "consequences": "Consumer blueprints that expose a service publicly declare capabilities: [tunnelBridge] on their applied contract to know a bridge is in place. Composition with zeroTrustGate (edge-cloudflare-access) toggles the Access-gated ingress shape per ADR-4003. A T-3-only project (no reverse proxy) declares no 80/443 firewall rule; the tunnel is the sole path from the edge to the origin. Rebuild-from-manifest is always possible: the manifest is the source of truth, the running connector is derivative. Folding this shape into edge-cloudflare-access was rejected: Access is an authorisation gate, Tunnel is an ingress bridge; the responsibilities are distinct and one applies without the other.",
+  "consequences": "Consumer blueprints that expose a service publicly declare capabilities: [tunnelBridge] on their applied contract to know a bridge is in place. Composition with zeroTrustGate (edge-cloudflare-access) toggles the Access-gated ingress shape per ADR-4003. A tunnel-only project (no reverse proxy) declares no 80/443 firewall rule; the tunnel is the sole path from the edge to the origin. Rebuild-from-manifest is always possible: the manifest is the source of truth, the running connector is derivative. Folding this shape into edge-cloudflare-access was rejected: Access is an authorisation gate, Tunnel is an ingress bridge; the responsibilities are distinct and one applies without the other.",
   "alternativesConsidered": [
     {
       "name": "Fold into edge-cloudflare-access as an adapter",
-      "reason": "Access is an authorisation gate on top of an ingress; Tunnel is an ingress bridge. One applies without the other. Folding conflated two decisions the operator ships separately. Rejected per Baz ruling decision 21."
+      "reason": "Access is an authorisation gate on top of an ingress; Tunnel is an ingress bridge. One applies without the other. Folding conflated two decisions the operator ships separately. Rejected during round-7 blueprint-scope definition."
     },
     {
       "name": "Ship a Tailscale Funnel or Fly.io proxy sibling in the same PR",
@@ -19,5 +19,5 @@
     }
   ],
   "createdAt": "2026-09-08T00:00:00.000Z",
-  "updatedAt": "2026-09-08T00:00:00.000Z"
+  "updatedAt": "2026-09-09T13:30:00.000Z"
 }