rcf-lite 0.26.0 → 0.28.0

package/blueprints/edge-cloudflare-tunnel/contributions/adrs/adr-4002-edge-cloudflare-tunnel-connector-runtime.json

@@ -6,7 +6,7 @@
   "status": "accepted",
   "title": "Connector runtime: compose-service default when containerHost applied; systemd-unit alternative on bare cloudHost",
   "context": "The cloudflared connector runs in one of two supported vendor shapes: as a container image published on the cloudflared downloads page, or as a systemd unit installed via the vendor package per the cloudflared as-a-service local-configuration-file docs. An applying project running its stack under docker compose has a natural home for the connector alongside its other services (same network, same logging driver, same restart policy). An applying project running bare on the host has no compose stack and needs a systemd unit for boot ordering and journald logging. Standards trace clause: Cloudflare cloudflared as-a-service documented systemd unit per hetzner-round-7-spec-2026-09-07.md.",
-  "decision": "The connector runtime is elicited via connector-runtime with enum {compose-service, systemd-unit} and recommendedDefault compose-service. When the containerHost capability is applied (T-2 platform-docker-compose-host) the shipped default is compose-service; when the host runs bare (only T-1 applied) the operator picks systemd-unit at apply time. Standards trace clause: Cloudflare cloudflared as-a-service documented systemd unit per hetzner-round-7-spec-2026-09-07.md.",
+  "decision": "The connector runtime is elicited via connector-runtime with enum {compose-service, systemd-unit} and recommendedDefault compose-service. When the containerHost capability is applied (via platform-docker-compose-host) the shipped default is compose-service; when the host runs bare (only deploy-hetzner-server applied) the operator picks systemd-unit at apply time. Standards trace clause: Cloudflare cloudflared as-a-service documented systemd unit per hetzner-round-7-spec-2026-09-07.md.",
   "consequences": "The fixture ships both variants and both pass the local probes (manifest-schema-validate, cloudflared-config-lint, aud-presence-check). A future non-Cloudflare tunnel sibling (Tailscale Funnel, Fly.io proxy) reuses the runtime enum shape but the elicit lives on that sibling own ADR (conflict-by-design on edgeIngressBridge per ADR-4001). The systemd variant carries an install caveat in the guide: the vendor package landed via apt or curl per the as-a-service docs, which is out of scope for the blueprint itself.",
   "alternativesConsidered": [
     {

package/blueprints/edge-cloudflare-tunnel/contributions/probes/manifest-schema-validate.mjs

@@ -82,7 +82,7 @@ function validateAgainstSchema(doc, schema) {
 
 function refuseOriginPortRules(doc) {
   // A service URL that binds to a host public interface is a policy
-  // violation for a T-3 apply (no reverse proxy). The catch-all
+  // violation for a tunnel-only apply (no reverse proxy). The catch-all
   // http_status:N is exempt.
   const violations = [];
   const rules = Array.isArray(doc.ingress) ? doc.ingress : [];
@@ -97,11 +97,11 @@ function refuseOriginPortRules(doc) {
     }
     const host = m[1];
     if (host === '0.0.0.0' || host === '') {
-      violations.push(`ingress[${i}] service '${svc}' binds to a host public interface (${host || 'empty'}); T-3 requires internal addresses only`);
+      violations.push(`ingress[${i}] service '${svc}' binds to a host public interface (${host || 'empty'}); tunnel-only apply requires internal addresses only`);
       continue;
     }
     if (/^\d+\.\d+\.\d+\.\d+$/.test(host) && host !== '127.0.0.1') {
-      violations.push(`ingress[${i}] service '${svc}' binds to a numeric IP that is not loopback; T-3 requires internal names or loopback`);
+      violations.push(`ingress[${i}] service '${svc}' binds to a numeric IP that is not loopback; tunnel-only apply requires internal names or loopback`);
     }
   }
   return violations;

package/blueprints/edge-cloudflare-tunnel/contributions/probes/probe-utils.mjs

@@ -1,4 +1,4 @@
-// Shared helpers for edge-cloudflare-tunnel probes (round-7 T-3).
+// Shared helpers for edge-cloudflare-tunnel probes (round-7 edge).
 //
 // Runtime-dependency posture:
 // - manifest-schema-validate is dependency-free: it reads yaml text and
@@ -122,11 +122,22 @@ export async function runShim(probeName, engine, mainFn) {
 }
 
 export function accountBoundSkippedResult(anchorAcId, envList, note) {
+  // Positive-evidence rule (authoring standard section 7d): a probe that
+  // records `accountBoundSkipped: true` carries a `reason` field naming
+  // the exact env var(s) that were unset. Compute from process.env so
+  // the reason is a fact of the run, not a hand-copied string.
+  const unset = envList.filter((name) => process.env[name] !== 'true');
+  const reason = unset.length > 0 ? unset.join(', ') : envList.join(', ');
+  // Detail names only the variables actually missing, so a partial-skip
+  // (one first-tier gate set, the other unset) reads honestly instead of
+  // claiming the whole input list is unset.
+  const detailUnset = unset.length > 0 ? unset : envList;
   return {
     anchorAcId,
     verdict: 'skipped',
     accountBoundSkipped: true,
-    detail: `accountBound: ${envList.join(' or ')} unset; ${note}`,
+    reason,
+    detail: `accountBound: ${detailUnset.join(' or ')} unset; ${note}`,
   };
 }
 

package/blueprints/edge-cloudflare-tunnel/contributions/probes/real-account-connector-healthy.mjs

@@ -2,14 +2,13 @@
 //
 // anchorAcId: AC-tunnel-connectorHealthy (US-39102 contribution;
 // real-account-connector-healthy declared with tunnelConnectorUp).
-// C4 ruling: the AC-tunnel-* symbolic anchors on the tunnel blueprint
-// ARE the AC ids in the shipped US-39101..US-39108 contribution band
-// (see blueprints/edge-cloudflare-tunnel/contributions/user-stories/
+// The AC-tunnel-* symbolic anchors on this blueprint ARE the AC ids
+// in the shipped US-39101..US-39108 contribution band (see
+// blueprints/edge-cloudflare-tunnel/contributions/user-stories/
 // edge-cloudflare-tunnel-us-3910N.json); the anchors already resolve
-// to the shipped band, so no re-anchor is performed by H-2. The kv
-// treatment differed because those probes anchored AC-5xxx ids that
-// existed nowhere on the shelf; here the ids exist and match by
-// design.
+// to the shipped band, so no re-anchor is needed. The kv treatment
+// differed because those probes anchored AC-5xxx ids that existed
+// nowhere on the shelf; here the ids exist and match by design.
 //
 // accountBound: true (gates on CI_HAS_CLOUDFLARE_ACCOUNT AND
 // CI_HAS_HETZNER_ACCOUNT; the connector runs on a throwaway Hetzner
@@ -17,7 +16,7 @@
 //
 // Env-absent branch: pass-with-skip (spec section 3.5).
 // Env-present branch: provisions a throwaway Hetzner server through
-// the shared T-1 fixture provisionThrowawayServer, drives the
+// the shared throwaway-server fixture provisionThrowawayServer, drives the
 // cloudflared control surface through the cf-edge shim's
 // cloudflaredTunnelInfo({ tunnelName }) call, asserts at least one
 // HEALTHY connector, and captures a tunnelConnectorUp event
@@ -28,7 +27,7 @@
 //
 // The shim seams (cloudflaredTunnelInfo, event capture) allow the
 // driver path and mutation switches to be exercised locally without
-// a real Cloudflare account; the real-account run happens at HQ
+// a real Cloudflare account; the real-account run happens in the operator account
 // gate time.
 
 import { runShim, accountBoundSkippedResult } from './probe-utils.mjs';

package/blueprints/edge-cloudflare-tunnel/contributions/probes/real-account-tunnel-hostname-routes.mjs

@@ -1,6 +1,6 @@
 // Probe: real-account-tunnel-hostname-routes.
 //
-// anchorAcId list (unchanged per H-2 C4 ruling; the AC-tunnel-* ids
+// anchorAcId list (the AC-tunnel-* ids
 // ARE the shipped AC ids in the US-39104 / US-39106 contribution
 // bodies):
 // - AC-tunnel-hostnameRoutes (public-hostname sub-case: ingress rule
@@ -16,7 +16,7 @@
 // - Access-gated sub-case activated only when CI_HAS_CLOUDFLARE_ACCESS
 //   is ALSO set. Env-absent branch keeps pass-with-skip; a pass must
 //   never be reachable from CI_HAS_CLOUDFLARE_ACCOUNT presence alone.
-// - HQ note: Cloudflare Access is not enabled on the HQ account, so
+// - Deployment note: Cloudflare Access is not enabled on the operator account, so
 //   at gate time the AUD sub-case stays pass-with-skip; expected,
 //   not a driver defect.
 //

package/blueprints/edge-cloudflare-tunnel/contributions/requirements/edge-cloudflare-tunnel-req-001.json

@@ -2,7 +2,7 @@
   "reqId": "edge-cloudflare-tunnel-REQ-001",
   "prdId": "PRD-001",
   "title": "Connector install shape switches on applied containerHost (compose-service default; systemd-unit for bare cloudHost); cloudflaredReady fires on boot",
-  "description": "The blueprint contributes a cloudflared connector whose runtime shape is elicited via ADR-4002 with enum {compose-service, systemd-unit} and recommendedDefault compose-service. When containerHost is applied (T-2 platform-docker-compose-host on top of T-1 deploy-hetzner-server) the connector ships as a compose service alongside the applying project services on the same web-net network. When the host runs bare (only T-1 applied) the connector ships as a systemd unit per the vendor local-configuration-file docs. Either shape emits cloudflaredReady on boot with connector id, region and version metadata (metadata only; no token or credentials in the payload).",
+  "description": "The blueprint contributes a cloudflared connector whose runtime shape is elicited via ADR-4002 with enum {compose-service, systemd-unit} and recommendedDefault compose-service. When containerHost is applied (via platform-docker-compose-host on top of deploy-hetzner-server) the connector ships as a compose service alongside the applying project services on the same web-net network. When the host runs bare (only deploy-hetzner-server applied) the connector ships as a systemd unit per the vendor local-configuration-file docs. Either shape emits cloudflaredReady on boot with connector id, region and version metadata (metadata only; no token or credentials in the payload). Names the declared `tunnelBridge` capability token: the connector shape is the runtime that supplies the token, so once the applying project boots either variant the `tunnelBridge` promise is live.",
   "category": "functional",
   "domain": "edge",
   "priority": "must",
@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-08T00:00:00.000Z",
-  "updatedAt": "2026-09-08T00:00:00.000Z"
+  "updatedAt": "2026-09-10T00:00:00.000Z",
+  "deliveredBy": {
+    "tacId": "TAC-4001-edge-cloudflare-tunnel-connector-shape",
+    "field": "responsibilities.cloudflaredReady"
+  }
 }

package/blueprints/edge-cloudflare-tunnel/contributions/requirements/edge-cloudflare-tunnel-req-002.json

@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-08T00:00:00.000Z",
-  "updatedAt": "2026-09-08T00:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00.000Z",
+  "deliveredBy": {
+    "tacId": "TAC-4002-edge-cloudflare-tunnel-manifest-schema",
+    "field": "responsibilities.manifestSchema"
+  }
 }

package/blueprints/edge-cloudflare-tunnel/contributions/requirements/edge-cloudflare-tunnel-req-003.json

@@ -1,8 +1,8 @@
 {
   "reqId": "edge-cloudflare-tunnel-REQ-003",
   "prdId": "PRD-001",
-  "title": "No public origin ports on the host (T-1 firewall stays 22 open plus 80/443 only when a reverse proxy is applied; manifest refuses an origin-port request)",
-  "description": "The applying project MUST NOT open a public port on the host firewall for the origin path when only edge-cloudflare-tunnel provides ingress. T-1 deploy-hetzner-server firewall allows 22 unconditionally and 80/443 only when a reverse proxy is applied. A project applying only T-1 plus T-3 (no reverse proxy) declares zero 80/443 rules; the tunnel manifest schema refuses ingress rules whose service URL binds to a host public interface.",
+  "title": "No public origin ports on the host (the deploy-hetzner-server firewall stays 22 open plus 80/443 only when a reverse proxy is applied; manifest refuses an origin-port request)",
+  "description": "The applying project MUST NOT open a public port on the host firewall for the origin path when only edge-cloudflare-tunnel provides ingress. The deploy-hetzner-server firewall allows 22 unconditionally and 80/443 only when a reverse proxy is applied. A project applying only deploy-hetzner-server and edge-cloudflare-tunnel (no reverse proxy) declares zero 80/443 rules; the tunnel manifest schema refuses ingress rules whose service URL binds to a host public interface.",
   "category": "functional",
   "domain": "edge",
   "priority": "must",
@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-08T00:00:00.000Z",
-  "updatedAt": "2026-09-08T00:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00.000Z",
+  "deliveredBy": {
+    "tacId": "TAC-4002-edge-cloudflare-tunnel-manifest-schema",
+    "field": "responsibilities.noPublicOrigin"
+  }
 }

package/blueprints/edge-cloudflare-tunnel/contributions/requirements/edge-cloudflare-tunnel-req-004.json

@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-08T00:00:00.000Z",
-  "updatedAt": "2026-09-08T00:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00.000Z",
+  "deliveredBy": {
+    "tacId": "TAC-4003-edge-cloudflare-tunnel-access-binding",
+    "field": "responsibilities.accessGated"
+  }
 }

package/blueprints/edge-cloudflare-tunnel/contributions/requirements/edge-cloudflare-tunnel-req-005.json

@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-08T00:00:00.000Z",
-  "updatedAt": "2026-09-08T00:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00.000Z",
+  "deliveredBy": {
+    "tacId": "TAC-4002-edge-cloudflare-tunnel-manifest-schema",
+    "field": "responsibilities.credentialsDiscipline"
+  }
 }

package/blueprints/edge-cloudflare-tunnel/contributions/requirements/edge-cloudflare-tunnel-req-006.json

@@ -0,0 +1,22 @@
+{
+  "reqId": "edge-cloudflare-tunnel-REQ-006",
+  "prdId": "PRD-001",
+  "title": "Zone resolution and AUD-mandatory-when-gated: elicited cloudflare-zone-secret resolves via the vault seam; access-aud is mandatory whenever zeroTrustGate is applied",
+  "description": "At apply time the elicited cloudflare-zone-secret (a security-secrets-management reference) is resolved via the applied vault seam. The plaintext zone id never lands on disk in the applying tree; only a secretRef reaches the manifest and the applied sidecar. An unresolved reference refuses apply with code apply.zone-unresolved. A Cloudflare API 4xx on the tunnel-route call for the resolved zone refuses apply with code apply.zone-unauthorised. Additionally, when zeroTrustGate is present on appliedCapabilities, the elicited access-aud MUST be non-blank; apply refuses with code apply.tunnel-aud-missing otherwise (never a silent public-hostname fallback under an applied gate).",
+  "category": "security",
+  "domain": "edge",
+  "priority": "must",
+  "rationale": "Closes the review P0 F-1 (elicit collected and ignored) and specimen F-3 (access-aud silent-degrade precedence). Aligns the zone-secret elicit with security-secrets-management discipline; ties the AUD-mandatory reading of REQ-004 to a machine-observable apply refusal.",
+  "tags": [
+    "blueprint:edge-cloudflare-tunnel",
+    "capability:tunnelBridge"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-09T00:00:00.000Z",
+  "updatedAt": "2026-09-09T00:00:00.000Z",
+  "deliveredBy": {
+    "tacId": "TAC-4004-edge-cloudflare-tunnel-zone-and-hostname-apply",
+    "field": "responsibilities.zoneResolve"
+  }
+}

package/blueprints/edge-cloudflare-tunnel/contributions/requirements/edge-cloudflare-tunnel-req-007.json

@@ -0,0 +1,22 @@
+{
+  "reqId": "edge-cloudflare-tunnel-REQ-007",
+  "prdId": "PRD-001",
+  "title": "Public-hostname template expansion at apply: inputs, output, malformed refusal and duplicate refusal",
+  "description": "The elicited public-hostname-template (default <service>.<zone>) is expanded per ingress rule at apply time. Substitution inputs are exactly two placeholders: <service> (the ingress rule service name) and <zone> (the resolved zone domain). The output is a fully-qualified DNS name committed to the ingress rule and to the applied sidecar. A template with an undefined placeholder, an unclosed brace, or a rendered value that violates DNS label rules (labels longer than 63 chars, empty labels, characters outside [a-z0-9-]) refuses apply with code apply.hostname-template-malformed. Two ingress rules expanding to the same concrete hostname refuses apply with code apply.hostname-template-duplicate.",
+  "category": "functional",
+  "domain": "edge",
+  "priority": "must",
+  "rationale": "Closes review P0 F-2 (hostname-template elicit collected and ignored). Names the substitution inputs, the output, the malformed refusal and the duplicate refusal so apply can bind each failure mode to an AC.",
+  "tags": [
+    "blueprint:edge-cloudflare-tunnel",
+    "capability:tunnelBridge"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-09T00:00:00.000Z",
+  "updatedAt": "2026-09-09T00:00:00.000Z",
+  "deliveredBy": {
+    "tacId": "TAC-4004-edge-cloudflare-tunnel-zone-and-hostname-apply",
+    "field": "responsibilities.hostnameTemplateExpand"
+  }
+}

package/blueprints/edge-cloudflare-tunnel/contributions/tacs/tac-4001-edge-cloudflare-tunnel-connector-shape.json

@@ -5,7 +5,7 @@
   "version": "1.0.0",
   "status": "approved",
   "name": "Edge-cloudflare-tunnel connector install shape",
-  "purpose": "The cloudflared connector installs in one of two runtime shapes as selected by ADR-4002 from the applied capability set. When containerHost is applied (T-2 platform-docker-compose-host on top of T-1 deploy-hetzner-server) the connector ships as a compose service alongside the applying project services on the same web-net network with no host ports and a healthcheck. When the host runs bare (only T-1 applied) the connector ships as a systemd unit per the vendor local-configuration-file docs. Either shape emits cloudflaredReady on boot with connector id, region and version metadata (metadata only).",
+  "purpose": "The cloudflared connector installs in one of two runtime shapes as selected by ADR-4002 from the applied capability set. When containerHost is applied (via platform-docker-compose-host on top of deploy-hetzner-server) the connector ships as a compose service alongside the applying project services on the same web-net network with no host ports and a healthcheck. When the host runs bare (only deploy-hetzner-server applied) the connector ships as a systemd unit per the vendor local-configuration-file docs. Either shape emits cloudflaredReady on boot with connector id, region and version metadata (metadata only).",
   "responsibilities": [
     "Ship the compose-service variant under packages/rcf-lite/test/fixtures/hetzner-throwaway-server/cloudflared/compose-service/ (AC-tunnel-connectorShape).",
     "Ship the systemd-unit variant under packages/rcf-lite/test/fixtures/hetzner-throwaway-server/cloudflared/systemd-unit/ (AC-tunnel-connectorShape).",

package/blueprints/edge-cloudflare-tunnel/contributions/tacs/tac-4004-edge-cloudflare-tunnel-zone-and-hostname-apply.json

@@ -0,0 +1,29 @@
+{
+  "tacId": "TAC-4004-edge-cloudflare-tunnel-zone-and-hostname-apply",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "name": "Zone resolution and public-hostname template expansion at apply",
+  "purpose": "The apply-verb path in the blueprint reads the elicited cloudflare-zone-secret (a security-secrets-management reference resolved at apply time), fetches the zone id via the vault seam, and never inlines the identifier into a manifest. The same apply pass expands the elicited public-hostname-template (default <service>.<zone>) per ingress rule to produce concrete hostnames. Apply refuses on: unresolved zone reference, unauthorised zone (Cloudflare API returns 4xx on the tunnel-route call), malformed hostname template, duplicate expanded hostnames across ingress rules. The DNS route for each expanded hostname is created via the Cloudflare API tunnels-routes endpoint or validated to already exist; a failed route creation refuses apply. This TAC anchors AC-tunnel-zoneResolve, AC-tunnel-zoneUnauthorised, AC-tunnel-hostnameTemplateExpand, AC-tunnel-hostnameTemplateMalformed, AC-tunnel-hostnameTemplateDuplicate and AC-tunnel-audMandatoryWhenGated.",
+  "responsibilities": [
+    "Resolve the elicited cloudflare-zone-secret via the security-secrets-management vault seam at apply; refuse apply.zone-unresolved when the reference does not resolve (AC-tunnel-zoneResolve).",
+    "Never inline the resolved zone id into the tunnel manifest or the applied sidecar in plaintext; only a secretRef reaches disk (AC-tunnel-zoneResolve).",
+    "Refuse apply.zone-unauthorised when the Cloudflare API returns 4xx on the tunnel-route call for the resolved zone (AC-tunnel-zoneUnauthorised).",
+    "Expand the elicited public-hostname-template per ingress rule to produce concrete hostnames; template inputs are {service, zone} and the output is the fully-qualified hostname the ingress rule commits to (AC-tunnel-hostnameTemplateExpand).",
+    "Refuse apply.hostname-template-malformed when the template contains an undefined placeholder, an unclosed brace, or expands to an invalid DNS label (AC-tunnel-hostnameTemplateMalformed).",
+    "Refuse apply.hostname-template-duplicate when two or more ingress rules expand to the same concrete hostname (AC-tunnel-hostnameTemplateDuplicate).",
+    "Refuse apply.tunnel-aud-missing when zeroTrustGate is applied and the elicited access-aud is blank (AC-tunnel-audMandatoryWhenGated)."
+  ],
+  "internalStructure": "One apply-time module that reads the elicited zone and hostname template, resolves the zone via security-secrets-management, calls the Cloudflare API tunnel-route endpoint per expanded hostname, and writes the applied sidecar with the concrete hostnames plus a secretRef for the zone (never the plaintext zone id).",
+  "interfaces": [
+    {
+      "name": "resolveZoneAndExpandHostnames",
+      "kind": "facade",
+      "summary": "Apply-time facade returning the resolved zone secretRef and the array of concrete hostname expansions per ingress rule."
+    }
+  ],
+  "dependencies": [],
+  "createdAt": "2026-09-09T00:00:00.000Z",
+  "updatedAt": "2026-09-09T00:00:00.000Z"
+}

package/blueprints/edge-cloudflare-tunnel/contributions/user-stories/edge-cloudflare-tunnel-us-39101.json

@@ -11,14 +11,50 @@
   "acceptanceCriteria": [
     {
       "id": "AC-tunnel-connectorShape",
-      "description": "The applied fixture ships both variants under packages/rcf-lite/test/fixtures/hetzner-throwaway-server/cloudflared/{compose-service,systemd-unit}/; the compose-service variant defines a cloudflared service on the same web-net network as the T-2 web and caddy services with no host ports, restart unless-stopped and a healthcheck; the systemd-unit variant ships a cloudflared.service unit file per the vendor local-configuration-file docs.",
+      "description": "The applied fixture ships both variants under packages/rcf-lite/test/fixtures/hetzner-throwaway-server/cloudflared/{compose-service,systemd-unit}/; the compose-service variant defines a cloudflared service on the same web-net network as the compose-host web and caddy services with no host ports, restart unless-stopped and a healthcheck; the systemd-unit variant ships a cloudflared.service unit file per the vendor local-configuration-file docs.",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-4001-edge-cloudflare-tunnel-connector-shape",
+        "field": "responsibilities.compose-service"
+      },
+      "given": "the applied fixture at packages/rcf-lite/test/fixtures/hetzner-throwaway-server/cloudflared/ with the compose-service and systemd-unit variants both present",
+      "when": "the anatomy test walks the fixture tree and reads each variant shape",
+      "then": "the compose-service variant defines a cloudflared service on the web-net network with no host ports, restart unless-stopped and a healthcheck; the systemd-unit variant ships a cloudflared.service unit file per the vendor local-configuration-file docs"
+    },
+    {
+      "id": "AC-tunnel-connectorPrecedence",
+      "description": "Given the elicited connector-runtime and the applied capability set, precedence is: applied containerHost + elicit \"compose-service\" -> compose-service variant; bare cloudHost (no containerHost) + elicit \"systemd-unit\" -> systemd-unit variant; applied containerHost + elicit \"systemd-unit\" refuses at apply with code apply.connector-runtime-incompatible naming both the applied capability and the elicit value; bare cloudHost + elicit \"compose-service\" refuses at apply with the same code.",
+      "given": "the applied fixture with the four combinations of containerHost applied/absent and elicited connector-runtime compose-service/systemd-unit",
+      "when": "the applying agent runs apply against each combination",
+      "then": "the two compatible combinations select the matching variant and the two incompatible combinations refuse with apply.connector-runtime-incompatible",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-4001-edge-cloudflare-tunnel-connector-shape",
+        "field": "interfaces.default"
+      }
+    },
+    {
+      "id": "AC-tunnel-capabilityToken",
+      "description": "The applied blueprint's manifest declares the `tunnelBridge` capability token, and the connector variant selected by the applied capability set (compose-service under containerHost; systemd-unit on a bare cloudHost) is present and boots per AC-tunnel-connectorShape; therefore the `tunnelBridge` capability the manifest promises is live at runtime.",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-4001-edge-cloudflare-tunnel-connector-shape",
+        "field": "responsibilities.cloudflaredReady"
+      },
+      "given": "the applied blueprint manifest at `blueprints/edge-cloudflare-tunnel/blueprint.json` and the applied connector variant on disk under the fixture at `packages/rcf-lite/test/fixtures/hetzner-throwaway-server/cloudflared/`",
+      "when": "the anatomy test reads `blueprint.json` and walks the fixture tree for the two variants",
+      "then": "the manifest carries `tunnelBridge` on its `capabilities[]` list and both connector variants are present on disk, so the applied project inherits a working `tunnelBridge` runtime"
     }
   ],
   "tacIds": [
     "TAC-4001-edge-cloudflare-tunnel-connector-shape"
   ],
   "createdAt": "2026-09-08T00:00:00.000Z",
-  "updatedAt": "2026-09-08T00:00:00.000Z"
+  "updatedAt": "2026-09-10T00:00:00.000Z"
 }

package/blueprints/edge-cloudflare-tunnel/contributions/user-stories/edge-cloudflare-tunnel-us-39102.json

@@ -4,21 +4,40 @@
   "reqId": "edge-cloudflare-tunnel-REQ-001",
   "version": "1.0.0",
   "status": "approved",
-  "title": "Cloudflared connector reports healthy on boot (tunnelConnectorUp fires with connector id, region, version)",
+  "title": "Connector boots (cloudflaredReady) and each connector reports up (tunnelConnectorUp) with metadata-only payloads",
   "asA": "shelf consumer applying edge-cloudflare-tunnel v1.0.0 on a cloudHost",
-  "iWant": "the connector to emit a tunnelConnectorUp event on boot with connector id, region and version metadata (metadata only)",
+  "iWant": "the connector on boot to fire exactly one cloudflaredReady event with a metadata-only payload naming the connector id, region and version, and the real-account cloudflared tunnel info surface to fire a per-connector tunnelConnectorUp event once each connector is healthy",
   "soThat": "the observability sink proves the tunnel is up without a shell into the host",
   "acceptanceCriteria": [
     {
       "id": "AC-tunnel-connectorHealthy",
       "description": "real-account-connector-healthy probe declares accountBound true (on CI_HAS_CLOUDFLARE_ACCOUNT AND CI_HAS_HETZNER_ACCOUNT) and records accountBoundSkipped when either is unset. When both are set the probe drives cloudflared tunnel info against the fixture tunnel and asserts at least one healthy connector plus a tunnelConnectorUp event with connector id, region and version.",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-4001-edge-cloudflare-tunnel-connector-shape",
+        "field": "responsibilities.cloudflaredReady"
+      }
+    },
+    {
+      "id": "AC-tunnel-cloudflaredReady",
+      "description": "Given the connector on boot, exactly one cloudflaredReady event fires on the injected sink with a metadata-only payload {connectorId, region, version}; no token, credential, ingress rule literal or account tag appears in the payload; the payload is Object.frozen at the connector boundary; the tunnelConnectorUp per-tunnel event is a distinct, later event tied to cloudflared tunnel info and is not conflated with cloudflaredReady.",
+      "given": "the fixture connector wired to the injected event sink at process boot",
+      "when": "the connector process reaches boot-complete",
+      "then": "exactly one cloudflaredReady with the metadata-only payload fires and no credential or tunnel-id literal appears in the payload",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-4001-edge-cloudflare-tunnel-connector-shape",
+        "field": "responsibilities.cloudflaredReady"
+      }
     }
   ],
   "tacIds": [
     "TAC-4001-edge-cloudflare-tunnel-connector-shape"
   ],
   "createdAt": "2026-09-08T00:00:00.000Z",
-  "updatedAt": "2026-09-08T00:00:00.000Z"
+  "updatedAt": "2026-09-09T12:00:00.000Z"
 }

package/blueprints/edge-cloudflare-tunnel/contributions/user-stories/edge-cloudflare-tunnel-us-39103.json

@@ -11,14 +11,64 @@
   "acceptanceCriteria": [
     {
       "id": "AC-tunnel-manifestSchema",
-      "description": "manifest-schema-validate probe passes on the canonical fixture and fails when the fixture is mutated (SIMULATE_MANIFEST_INVALID_TUNNEL_ID, SIMULATE_MANIFEST_CREDENTIALS_INLINE, SIMULATE_MANIFEST_MISSING_CATCHALL) naming the offending field.",
+      "description": "Given the canonical fixture cloudflare/tunnels/<name>.yaml (uuid tunnel id, credentialsFile.secretRef reference, ingress array whose last entry is the catch-all `service: http_status:404`), when the manifest-schema-validate probe runs against the fixture, the probe returns aggregateVerdict:pass with zero findings.",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-4002-edge-cloudflare-tunnel-manifest-schema",
+        "field": "interfaces.schema"
+      },
+      "given": "the canonical fixture manifest with the three required-shape invariants (uuid tunnel id, credentialsFile.secretRef reference, terminal catch-all)",
+      "when": "manifest-schema-validate runs against the canonical fixture",
+      "then": "the probe returns aggregateVerdict:pass with zero findings"
+    },
+    {
+      "id": "AC-tunnel-manifestSchemaInvalidTunnelId",
+      "description": "Given the fixture manifest mutated via SIMULATE_MANIFEST_INVALID_TUNNEL_ID (tunnel id no longer a UUID), when manifest-schema-validate runs, the probe returns aggregateVerdict:fail and the detail names the offending field `tunnel` from the schema.",
+      "given": "the fixture cloudflare/tunnels/<name>.yaml mutated so tunnel is not a UUID (SIMULATE_MANIFEST_INVALID_TUNNEL_ID=true)",
+      "when": "manifest-schema-validate runs against the mutated fixture",
+      "then": "the probe returns aggregateVerdict:fail with detail naming the schema field `tunnel`",
+      "testable": true,
+      "scope": "library",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-4002-edge-cloudflare-tunnel-manifest-schema",
+        "field": "interfaces.schema"
+      }
+    },
+    {
+      "id": "AC-tunnel-manifestSchemaCredentialsInline",
+      "description": "Given the fixture manifest mutated via SIMULATE_MANIFEST_CREDENTIALS_INLINE (credentials JSON body inlined instead of the required credentialsFile.secretRef reference), when manifest-schema-validate runs, the probe returns aggregateVerdict:fail and the detail names the offending field `credentialsFile.secretRef`.",
+      "given": "the fixture manifest with credentials inlined as JSON rather than referenced by secretRef (SIMULATE_MANIFEST_CREDENTIALS_INLINE=true)",
+      "when": "manifest-schema-validate runs",
+      "then": "the probe returns aggregateVerdict:fail with detail naming the schema field `credentialsFile.secretRef`",
+      "testable": true,
+      "scope": "library",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-4002-edge-cloudflare-tunnel-manifest-schema",
+        "field": "responsibilities.credentialsSecretRef"
+      }
+    },
+    {
+      "id": "AC-tunnel-manifestSchemaMissingCatchall",
+      "description": "Given the fixture manifest mutated via SIMULATE_MANIFEST_MISSING_CATCHALL (last ingress rule is not the required `service: http_status:404` catch-all), when manifest-schema-validate runs, the probe returns aggregateVerdict:fail and the detail names the ingress array's terminal catch-all requirement.",
+      "given": "the fixture manifest with the terminal http_status:404 catch-all ingress rule removed (SIMULATE_MANIFEST_MISSING_CATCHALL=true)",
+      "when": "manifest-schema-validate runs",
+      "then": "the probe returns aggregateVerdict:fail with detail naming the ingress array's terminal `service: http_status:404` catch-all requirement",
+      "testable": true,
+      "scope": "library",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-4002-edge-cloudflare-tunnel-manifest-schema",
+        "field": "interfaces.schema"
+      }
     }
   ],
   "tacIds": [
     "TAC-4002-edge-cloudflare-tunnel-manifest-schema"
   ],
   "createdAt": "2026-09-08T00:00:00.000Z",
-  "updatedAt": "2026-09-08T00:00:00.000Z"
+  "updatedAt": "2026-09-09T13:00:00.000Z"
 }

package/blueprints/edge-cloudflare-tunnel/contributions/user-stories/edge-cloudflare-tunnel-us-39104.json

@@ -11,14 +11,44 @@
   "acceptanceCriteria": [
     {
       "id": "AC-tunnel-hostnameRoutes",
-      "description": "cloudflared-config-lint probe runs cloudflared tunnel ingress validate against the fixture manifest (through the cloudflare/cloudflared:2026.8.3 container image when the binary is not on PATH) and exits 0 on the canonical fixture; SIMULATE_INGRESS_INVALID rewrites the service URL to an unresolvable scheme and the probe FAILS.",
+      "description": "Given the canonical fixture manifest, when the cloudflared-config-lint probe runs `cloudflared tunnel ingress validate` (via the cloudflare/cloudflared:2026.8.3 container image when the binary is not on PATH) against the fixture manifest, the probe exits 0 and returns aggregateVerdict:pass.",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-4002-edge-cloudflare-tunnel-manifest-schema",
+        "field": "interfaces.schema"
+      },
+      "vendorCitation": {
+        "url": "https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/do-more-with-tunnels/local-management/configuration-file/",
+        "verifiedOn": "2026-09-09"
+      },
+      "given": "the canonical fixture manifest with a valid ingress ruleset",
+      "when": "cloudflared-config-lint runs `cloudflared tunnel ingress validate` against the fixture",
+      "then": "the probe exits 0 and returns aggregateVerdict:pass"
+    },
+    {
+      "id": "AC-tunnel-hostnameRoutesInvalidIngress",
+      "description": "Given the fixture manifest mutated via SIMULATE_INGRESS_INVALID (an ingress rule service URL rewritten to an unresolvable scheme), when cloudflared-config-lint runs `cloudflared tunnel ingress validate` against the mutated fixture, the probe exits non-zero and returns aggregateVerdict:fail with detail naming the offending ingress rule index.",
+      "given": "the fixture manifest with one ingress rule's service URL rewritten to an unresolvable scheme (SIMULATE_INGRESS_INVALID=true)",
+      "when": "cloudflared-config-lint runs against the mutated fixture",
+      "then": "the probe exits non-zero and returns aggregateVerdict:fail with detail naming the offending ingress rule index",
+      "testable": true,
+      "scope": "library",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-4002-edge-cloudflare-tunnel-manifest-schema",
+        "field": "interfaces.schema"
+      },
+      "vendorCitation": {
+        "url": "https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/do-more-with-tunnels/local-management/configuration-file/",
+        "verifiedOn": "2026-09-09"
+      }
     }
   ],
   "tacIds": [
     "TAC-4002-edge-cloudflare-tunnel-manifest-schema"
   ],
   "createdAt": "2026-09-08T00:00:00.000Z",
-  "updatedAt": "2026-09-08T00:00:00.000Z"
+  "updatedAt": "2026-09-09T13:00:00.000Z"
 }

package/blueprints/edge-cloudflare-tunnel/contributions/user-stories/edge-cloudflare-tunnel-us-39105.json

@@ -11,14 +11,36 @@
   "acceptanceCriteria": [
     {
       "id": "AC-tunnel-noPublicOrigin",
-      "description": "manifest-schema-validate refuses under SIMULATE_ORIGIN_PORT_OPEN when an ingress rule service URL binds to 0.0.0.0 or a host public interface; the T-1 firewall on the ci-throwaway manifest stays 22 open plus 80/443 open only when a reverse proxy is applied.",
+      "description": "Given the fixture manifest mutated via SIMULATE_ORIGIN_PORT_OPEN (one ingress rule service URL rewritten to bind to 0.0.0.0 or a host public interface), when manifest-schema-validate runs, the probe returns aggregateVerdict:fail with detail naming the offending ingress rule index. The deploy-hetzner-server firewall on the ci-throwaway manifest stays 22 open plus 80/443 open only when a reverse proxy is applied.",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-4002-edge-cloudflare-tunnel-manifest-schema",
+        "field": "responsibilities.originPortRefusal"
+      },
+      "given": "the fixture manifest with one ingress rule service URL bound to 0.0.0.0 or a host public interface (SIMULATE_ORIGIN_PORT_OPEN=true)",
+      "when": "manifest-schema-validate runs against the mutated fixture",
+      "then": "the probe returns aggregateVerdict:fail with detail naming the offending ingress rule index"
+    },
+    {
+      "id": "AC-tunnel-noPublicOriginHappy",
+      "description": "Given the canonical fixture manifest (every ingress rule's service URL binds to an internal address: a compose service name or a loopback interface), when manifest-schema-validate runs, the probe returns aggregateVerdict:pass with no origin-port findings.",
+      "given": "the canonical fixture manifest with every ingress rule bound to an internal service or loopback",
+      "when": "manifest-schema-validate runs on the canonical fixture",
+      "then": "the probe returns aggregateVerdict:pass with no origin-port findings",
+      "testable": true,
+      "scope": "library",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-4002-edge-cloudflare-tunnel-manifest-schema",
+        "field": "responsibilities.originPortRefusal"
+      }
     }
   ],
   "tacIds": [
     "TAC-4002-edge-cloudflare-tunnel-manifest-schema"
   ],
   "createdAt": "2026-09-08T00:00:00.000Z",
-  "updatedAt": "2026-09-08T00:00:00.000Z"
+  "updatedAt": "2026-09-09T13:00:00.000Z"
 }