rcf-lite 0.26.0 → 0.28.0

package/blueprints/edge-cloudflare-tunnel/contributions/user-stories/edge-cloudflare-tunnel-us-39106.json

@@ -13,12 +13,96 @@
       "id": "AC-tunnel-accessGated",
       "description": "aud-presence-check probe reads each variant sidecar and asserts the ingress rules attach originRequest.access.aud on the access-gated variant and omit the block on the public-hostname variant. The shape flip is a pure function of the sidecar contents.",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-4003-edge-cloudflare-tunnel-access-binding",
+        "field": "responsibilities.audAttach"
+      },
+      "vendorCitation": {
+        "url": "https://developers.cloudflare.com/cloudflare-one/applications/configure-apps/self-hosted-public-app/",
+        "verifiedOn": "2026-09-09"
+      },
+      "given": "the fixture ships the access-gated and public-hostname sidecar variants under packages/rcf-lite/test/fixtures/hetzner-throwaway-server/cloudflared/ with the access-gated sidecar carrying an elicited AUD",
+      "when": "the aud-presence-check probe reads each variant sidecar's ingress rules",
+      "then": "the access-gated variant ingress rules all carry originRequest.access.aud and the public-hostname variant ingress rules all omit the originRequest.access block; the shape flip is a pure function of the sidecar contents"
+    },
+    {
+      "id": "AC-tunnel-accessGatedRejectMissing",
+      "description": "Given the access-gated variant on an account-bound run, when a request reaches the gated hostname with no Cf-Access-Jwt-Assertion header, cloudflared refuses at the edge and the origin never sees the request (the origin origin-hit counter stays at zero across N+1 requests). Applying agent sets: the applying agent sets the elicited access-aud tag and the applied project's Cf-Access-Jwt-Assertion signing team; the accept and reject observables are pure functions of that AUD.",
+      "given": "the account-bound fixture with an origin counter behind a gated hostname",
+      "when": "a client fires N+1 requests without a Cf-Access-Jwt-Assertion header",
+      "then": "every request is refused at the edge and the origin counter stays at zero",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-4003-edge-cloudflare-tunnel-access-binding",
+        "field": "responsibilities.accessGated"
+      },
+      "vendorCitation": {
+        "url": "https://developers.cloudflare.com/cloudflare-one/applications/configure-apps/self-hosted-public-app/",
+        "verifiedOn": "2026-09-09"
+      }
+    },
+    {
+      "id": "AC-tunnel-accessGatedRejectInvalid",
+      "description": "Given the access-gated variant, when a request reaches the gated hostname with a malformed or expired Cf-Access-Jwt-Assertion, cloudflared refuses at the edge and the origin origin-hit counter stays at zero across N+1 requests. Applying agent sets: the applying agent sets the elicited access-aud tag; the reject observable is a pure function of that AUD.",
+      "given": "the account-bound fixture with an origin counter behind a gated hostname",
+      "when": "a client fires N+1 requests with a malformed or expired Cf-Access-Jwt-Assertion",
+      "then": "every request is refused at the edge and the origin counter stays at zero",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-4003-edge-cloudflare-tunnel-access-binding",
+        "field": "responsibilities.accessGated"
+      },
+      "vendorCitation": {
+        "url": "https://developers.cloudflare.com/cloudflare-one/applications/configure-apps/self-hosted-public-app/",
+        "verifiedOn": "2026-09-09"
+      }
+    },
+    {
+      "id": "AC-tunnel-accessGatedRejectWrongAud",
+      "description": "Given the access-gated variant with an elicited AUD tag, when a request presents a well-signed Cf-Access-Jwt-Assertion whose aud claim does not match the elicited AUD, cloudflared refuses at the edge and the origin origin-hit counter stays at zero. Applying agent sets: the applying agent sets the elicited access-aud tag; a request whose JWT `aud` differs from the applied value is refused.",
+      "given": "the account-bound fixture with the elicited AUD tag configured",
+      "when": "a client fires a request with a well-signed JWT whose aud claim mismatches the elicited AUD",
+      "then": "the request is refused at the edge and the origin counter stays at zero",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-4003-edge-cloudflare-tunnel-access-binding",
+        "field": "responsibilities.accessGated"
+      },
+      "vendorCitation": {
+        "url": "https://developers.cloudflare.com/cloudflare-one/applications/configure-apps/self-hosted-public-app/",
+        "verifiedOn": "2026-09-09"
+      }
+    },
+    {
+      "id": "AC-tunnel-accessGatedAcceptValid",
+      "description": "Given the access-gated variant, when a request presents a well-signed Cf-Access-Jwt-Assertion whose aud claim matches the elicited AUD, the request reaches the origin exactly once and the origin origin-hit counter increments by one per accepted request. Applying agent sets: the applying agent sets the elicited access-aud tag; a request whose JWT `aud` matches the applied value is accepted.",
+      "given": "the account-bound fixture with the elicited AUD tag configured and an origin counter",
+      "when": "a client fires N requests each with a well-signed JWT whose aud matches the elicited AUD",
+      "then": "each request reaches the origin and the origin counter reads exactly N",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-4003-edge-cloudflare-tunnel-access-binding",
+        "field": "responsibilities.accessGated"
+      },
+      "vendorCitation": {
+        "url": "https://developers.cloudflare.com/cloudflare-one/applications/configure-apps/self-hosted-public-app/",
+        "verifiedOn": "2026-09-09"
+      }
     }
   ],
   "tacIds": [
     "TAC-4003-edge-cloudflare-tunnel-access-binding"
   ],
   "createdAt": "2026-09-08T00:00:00.000Z",
-  "updatedAt": "2026-09-08T00:00:00.000Z"
+  "updatedAt": "2026-09-09T13:00:00.000Z"
 }

package/blueprints/edge-cloudflare-tunnel/contributions/user-stories/edge-cloudflare-tunnel-us-39107.json

@@ -11,14 +11,36 @@
   "acceptanceCriteria": [
     {
       "id": "AC-tunnel-accessGatedRefuse",
-      "description": "aud-presence-check FAILS under SIMULATE_AUD_DROP when the gated fixture ingress drifts to omit the originRequest.access block. The finding names the affected rule and the missing AUD value.",
+      "description": "Given the gated fixture sidecar mutated via SIMULATE_AUD_DROP (one ingress rule drifts to omit the originRequest.access block), when aud-presence-check runs, the probe returns aggregateVerdict:fail with detail naming the affected ingress rule and the missing AUD value.",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-4003-edge-cloudflare-tunnel-access-binding",
+        "field": "responsibilities.audAttach"
+      },
+      "given": "the gated fixture sidecar with one ingress rule missing the originRequest.access block (SIMULATE_AUD_DROP=true)",
+      "when": "aud-presence-check runs on the mutated gated sidecar",
+      "then": "the probe returns aggregateVerdict:fail with detail naming the affected rule and the missing AUD value"
+    },
+    {
+      "id": "AC-tunnel-accessGatedRefuseHappy",
+      "description": "Given the canonical access-gated fixture sidecar (every non-catch-all ingress rule attaches the originRequest.access block with an AUD value), when aud-presence-check runs, the probe returns aggregateVerdict:pass with a zero-drift finding count on the gated variant.",
+      "given": "the canonical gated fixture sidecar with originRequest.access block attached on every non-catch-all rule",
+      "when": "aud-presence-check runs on the gated variant sidecar",
+      "then": "the probe returns aggregateVerdict:pass with a zero-drift finding count",
+      "testable": true,
+      "scope": "library",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-4003-edge-cloudflare-tunnel-access-binding",
+        "field": "responsibilities.audAttach"
+      }
     }
   ],
   "tacIds": [
     "TAC-4003-edge-cloudflare-tunnel-access-binding"
   ],
   "createdAt": "2026-09-08T00:00:00.000Z",
-  "updatedAt": "2026-09-08T00:00:00.000Z"
+  "updatedAt": "2026-09-09T13:00:00.000Z"
 }

package/blueprints/edge-cloudflare-tunnel/contributions/user-stories/edge-cloudflare-tunnel-us-39108.json

@@ -13,12 +13,45 @@
       "id": "AC-tunnel-credentialsDiscipline",
       "description": "The fixture credentials placeholder documents the 0o400 host mode and secretRef pattern; the manifest references the credentials via a secretRef; the grep-refuse pattern is documented in the guide; every cloudflaredReady, tunnelConnectorUp and ingressRuleReloaded event body captured by the in-process facade carries metadata only, and SIMULATE_EVENT_SECRECY_LEAK inserts the credentials literal into a lifecycle event body and the scan FAILS naming the leaked field.",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-4002-edge-cloudflare-tunnel-manifest-schema",
+        "field": "responsibilities.credentialsSecretRef"
+      }
+    },
+    {
+      "id": "AC-tunnel-credentialsHostMode",
+      "description": "Given the provisioned host file at the credentialsFile secretRef path, when the credentials-file host mode is inspected, the file exists at mode 0o400 owned by the cloudflared user; a fixture-induced mode of 0o600 or 0o644 refuses the probe with a stable code credentials.host-mode-drift naming the observed mode.",
+      "given": "the provisioned host fixture with the credentials file rendered from the secretRef",
+      "when": "the credentials-discipline probe stats the credentials-file path",
+      "then": "the file at mode 0o400 owned by the cloudflared user passes; induced 0o600/0o644 refuses with credentials.host-mode-drift",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-4002-edge-cloudflare-tunnel-manifest-schema",
+        "field": "responsibilities.credentialsDiscipline"
+      }
+    },
+    {
+      "id": "AC-tunnel-credentialsTrackedTreeScan",
+      "description": "Given the applying-tree git working set, when the grep-refuse scan walks every tracked file for the tunnel-id and account-tag literal substrings, no tracked file matches (the credentials remain out of the tracked tree); a fixture that commits a credentials JSON body refuses the probe with a stable code credentials.tracked-tree-leak naming the offending path.",
+      "given": "the applying-tree git working set with the tunnel id and account tag known from the manifest",
+      "when": "the credentials-discipline probe greps every tracked file for the two literal substrings",
+      "then": "no tracked file matches on the canonical fixture and the fixture-induced committed-credentials variant refuses with credentials.tracked-tree-leak",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-4002-edge-cloudflare-tunnel-manifest-schema",
+        "field": "responsibilities.credentialsDiscipline"
+      }
     }
   ],
   "tacIds": [
     "TAC-4002-edge-cloudflare-tunnel-manifest-schema"
   ],
   "createdAt": "2026-09-08T00:00:00.000Z",
-  "updatedAt": "2026-09-08T00:00:00.000Z"
+  "updatedAt": "2026-09-09T12:00:00.000Z"
 }

package/blueprints/edge-cloudflare-tunnel/contributions/user-stories/edge-cloudflare-tunnel-us-39109.json

@@ -0,0 +1,74 @@
+{
+  "usId": "edge-cloudflare-tunnel-US-39109",
+  "prdId": "PRD-001",
+  "reqId": "edge-cloudflare-tunnel-REQ-006",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Apply resolves the elicited cloudflare-zone-secret via the vault seam and refuses under the documented failure paths; enforces AUD-mandatory when zeroTrustGate is applied",
+  "asA": "shelf consumer applying edge-cloudflare-tunnel with a real Cloudflare zone secret and (optionally) edge-cloudflare-access",
+  "iWant": "apply to resolve the elicited zone secretRef via security-secrets-management, refuse on unresolved and unauthorised paths, and refuse when zeroTrustGate is applied but access-aud is blank",
+  "soThat": "a project that never wires the zone into the vault, or that has no Cloudflare authority on the resolved zone, or that turns on the gate without an AUD, fails at apply rather than at first inbound request",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-tunnel-zoneResolve",
+      "description": "Given the elicited cloudflare-zone-secret is a resolvable security-secrets-management reference, when apply runs, the resolver returns a zone id via the vault seam, no plaintext zone id lands in the applying tree (a grep on the tracked tree for the resolved value finds zero matches), and the applied sidecar carries only the secretRef.",
+      "given": "the fixture apply harness with a resolvable secretRef for cloudflare-zone-secret",
+      "when": "apply runs against the fixture project",
+      "then": "the resolver returns a zone id, the applied sidecar records only the secretRef, and a grep on the tracked tree for the resolved zone id finds zero matches",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-4004-edge-cloudflare-tunnel-zone-and-hostname-apply",
+        "field": "responsibilities.zoneResolve"
+      }
+    },
+    {
+      "id": "AC-tunnel-zoneUnresolved",
+      "description": "Given the elicited cloudflare-zone-secret does not resolve via the vault seam (the reference is missing, or the vault seam returns an error), when apply runs, apply refuses with code apply.zone-unresolved naming the elicit id and no applied sidecar is written.",
+      "given": "the fixture apply harness with an unresolvable secretRef for cloudflare-zone-secret",
+      "when": "apply runs",
+      "then": "apply refuses with code apply.zone-unresolved and no applied sidecar is written",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-4004-edge-cloudflare-tunnel-zone-and-hostname-apply",
+        "field": "responsibilities.zoneResolve"
+      }
+    },
+    {
+      "id": "AC-tunnel-zoneUnauthorised",
+      "description": "Given the injected Cloudflare API returns 401 or 403 on the tunnel-route call for the resolved zone id, when apply runs, apply refuses with code apply.zone-unauthorised naming the resolved zone id metadata (never the token) and no applied sidecar is written.",
+      "given": "the fixture apply harness with an injected Cloudflare API that returns 401/403",
+      "when": "apply runs against the resolved zone",
+      "then": "apply refuses with code apply.zone-unauthorised and no applied sidecar is written",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-4004-edge-cloudflare-tunnel-zone-and-hostname-apply",
+        "field": "responsibilities.zoneResolve"
+      }
+    },
+    {
+      "id": "AC-tunnel-audMandatoryWhenGated",
+      "description": "Given zeroTrustGate is present on the applied capability set and the elicited access-aud is blank, when apply runs, apply refuses with code apply.tunnel-aud-missing naming the elicit id; when access-aud is non-blank apply proceeds and the aud-presence-check probe asserts every ingress rule attaches originRequest.access.aud.",
+      "given": "the fixture apply harness with zeroTrustGate applied and access-aud successively blank and non-blank",
+      "when": "apply runs",
+      "then": "blank access-aud refuses with code apply.tunnel-aud-missing; non-blank access-aud proceeds and every ingress rule attaches originRequest.access.aud",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-4004-edge-cloudflare-tunnel-zone-and-hostname-apply",
+        "field": "responsibilities.audMandatoryWhenGated"
+      }
+    }
+  ],
+  "tacIds": [
+    "TAC-4004-edge-cloudflare-tunnel-zone-and-hostname-apply"
+  ],
+  "createdAt": "2026-09-09T00:00:00.000Z",
+  "updatedAt": "2026-09-09T12:00:00.000Z"
+}

package/blueprints/edge-cloudflare-tunnel/contributions/user-stories/edge-cloudflare-tunnel-us-39110.json

@@ -0,0 +1,60 @@
+{
+  "usId": "edge-cloudflare-tunnel-US-39110",
+  "prdId": "PRD-001",
+  "reqId": "edge-cloudflare-tunnel-REQ-007",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Apply expands the elicited public-hostname template per ingress rule and refuses on malformed templates and duplicate expansions",
+  "asA": "shelf consumer applying edge-cloudflare-tunnel with two or more ingress rules",
+  "iWant": "apply to expand <service>.<zone> per rule and refuse on malformed templates or duplicate expansions",
+  "soThat": "a template that would silently collide two rules on the same hostname is caught at apply rather than at first inbound request",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-tunnel-hostnameTemplateExpand",
+      "description": "Given the default template <service>.<zone> and two ingress rules (service names \"api\" and \"web\") under the resolved zone \"example.com\", when apply runs, the applied sidecar records ingress rules with concrete hostnames \"api.example.com\" and \"web.example.com\"; every rule's hostname field matches ^[a-z0-9-]+(\\.[a-z0-9-]+)+$. Applying agent sets: the applying agent sets the ingress rule service names, the resolved zone (via cloudflare-zone-secret) and, optionally, an override public-hostname-template.",
+      "given": "the fixture apply harness with the default template and two ingress rules",
+      "when": "apply runs and expands the template",
+      "then": "the applied sidecar carries the two concrete hostnames matching the DNS-label regex",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-4004-edge-cloudflare-tunnel-zone-and-hostname-apply",
+        "field": "responsibilities.hostnameTemplateExpand"
+      }
+    },
+    {
+      "id": "AC-tunnel-hostnameTemplateMalformed",
+      "description": "Given a template with an undefined placeholder (e.g. <unknown>), an unclosed brace (e.g. <service.<zone>), or a rendered value that violates DNS label rules (labels longer than 63 chars or characters outside [a-z0-9-]), when apply runs, apply refuses with code apply.hostname-template-malformed naming the offending template and no applied sidecar is written.",
+      "given": "the fixture apply harness with one of the malformed templates",
+      "when": "apply runs and expands the template",
+      "then": "apply refuses with code apply.hostname-template-malformed and no applied sidecar is written",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-4004-edge-cloudflare-tunnel-zone-and-hostname-apply",
+        "field": "responsibilities.hostnameTemplateExpand"
+      }
+    },
+    {
+      "id": "AC-tunnel-hostnameTemplateDuplicate",
+      "description": "Given two ingress rules whose distinct service names expand under the elicited template to the same concrete hostname (for example a template with the <service> placeholder omitted or replaced by a constant), when apply runs, apply refuses with code apply.hostname-template-duplicate naming the collided hostname and both offending rule indices; no applied sidecar is written.",
+      "given": "the fixture apply harness with two ingress rules expanding to the same hostname",
+      "when": "apply runs and computes the expansion table",
+      "then": "apply refuses with code apply.hostname-template-duplicate and no applied sidecar is written",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-4004-edge-cloudflare-tunnel-zone-and-hostname-apply",
+        "field": "responsibilities.hostnameTemplateExpand"
+      }
+    }
+  ],
+  "tacIds": [
+    "TAC-4004-edge-cloudflare-tunnel-zone-and-hostname-apply"
+  ],
+  "createdAt": "2026-09-09T00:00:00.000Z",
+  "updatedAt": "2026-09-09T13:00:00.000Z"
+}

package/blueprints/edge-cloudflare-tunnel/docs/topics.md

@@ -59,9 +59,9 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | platform-docker-compose-host | 38101-38899 | 39xx | shipped v1.0.0 | `containerHostContract` |
 | edge-cloudflare-tunnel | 39101-39899 | 40xx | shipped v1.0.0 | `edgeIngressBridge` |
 
-US 39101-39108 sit at the LOW end of the 39101-39899 band on purpose (watchpost run-4 lesson). A project-side story mechanically derived from an edge-cloudflare-tunnel REQ id into the number 39108 would collide against the shipped US-39108; band headroom (39109-39899) leaves that space.
+US 39101-39108 sit at the LOW end of the 39101-39899 band on purpose. A project-side story mechanically derived from an edge-cloudflare-tunnel REQ id into the number 39108 would collide against the shipped US-39108; band headroom (39109-39899) leaves that space.
 
-Edge-cloudflare-tunnel suffixes for this blueprint use the 4001-4003 block, continuing the widening pattern (deploy-hetzner-server 3801-3804 for the T-1 sibling, platform-docker-compose-host 3901-3904 for the T-2 sibling).
+Edge-cloudflare-tunnel suffixes for this blueprint use the 4001-4003 block, continuing the widening pattern (deploy-hetzner-server 3801-3804 for the host sibling, platform-docker-compose-host 3901-3904 for the compose-host sibling).
 
 ## Cross-references
 

package/blueprints/edge-cloudflare-tunnel/guide/edge-cloudflare-tunnel.md

@@ -7,15 +7,13 @@ what the connector looks like, what the manifest looks like, how the
 Access-gated shape composes on top of the public-hostname shape, and
 how the credentials-file discipline stays honest on every reapply.
 
-Ratifying spec: `projects/blueprint-library/specs/hetzner-round-7-spec-2026-09-07.md` section 5.3.
-
 ## When to reach for this blueprint
 
 Reach when the applying project needs to expose a service on the public
 internet without opening origin ports on the host and without standing
 up a bespoke reverse proxy in front of the CDN. The tunnel connector
 dials out to the Cloudflare edge and terminates ingress there; the host
-firewall (T-1 deploy-hetzner-server) can stay closed on 80/443 unless a
+firewall (from deploy-hetzner-server) can stay closed on 80/443 unless a
 reverse proxy is also applied.
 
 Do not reach for this blueprint when the applying project runs on
@@ -34,10 +32,10 @@ Reach for **compose-service** (the shipped default when `containerHost`
 is applied) when the applying project already runs docker compose on
 the host. The connector ships as another service in the same stack,
 sharing the compose network, the log driver and the restart discipline.
-The T-2 platform-docker-compose-host contract makes this the natural
-home; the connector composes on `containerHost` from T-2.
+The platform-docker-compose-host contract makes this the natural
+home; the connector composes on `containerHost` from platform-docker-compose-host.
 
-Reach for **systemd-unit** when the host runs bare (only T-1 applied)
+Reach for **systemd-unit** when the host runs bare (only deploy-hetzner-server applied)
 and there is no compose stack to add a service to. The connector runs
 as a systemd unit per the vendor cloudflared as-a-service documented
 systemd unit; the unit file lives at `/etc/systemd/system/cloudflared.service`
@@ -71,9 +69,15 @@ authorisation lives at the origin). The tunnel still terminates
 ingress at the CF edge; no origin port is opened; the difference is
 that cloudflared does not check for a JWT before forwarding.
 
-Graceful degrade: when Access is not applied, the blueprint still ships
-in public-hostname mode. The `aud-presence-check` probe runs on both
-fixture variants and asserts the shape flips correctly.
+Mode selection is a pure function of the applied capability set. When
+`zeroTrustGate` is present on the applied capabilities, the elicited
+`access-aud` value is **mandatory**: apply refuses with code
+`apply.tunnel-aud-missing` if the value is blank, and every ingress
+rule attaches an `originRequest.access` block. There is no silent
+degrade to public-hostname mode under an applied gate. When
+`zeroTrustGate` is absent, the tunnel serves in the deliberate
+public-hostname mode per ADR-4003; the `aud-presence-check` probe
+runs on both fixture variants and asserts the shape flips correctly.
 
 ## Tunnel manifest walkthrough
 
@@ -83,7 +87,7 @@ The applying project ships one tunnel manifest per named tunnel at
 ```yaml
 tunnel: 12345678-90ab-4cde-8f12-3456789abcde
 credentialsFile:
-  secretRef: hq-estate/CLOUDFLARE_TUNNEL_CREDENTIALS_MY_PROJECT
+  secretRef: vault/CLOUDFLARE_TUNNEL_CREDENTIALS_MY_PROJECT
 ingress:
   - hostname: my-app.example.com
     service: http://web:8080
@@ -96,7 +100,7 @@ non-catch-all rule:
 ```yaml
 tunnel: 12345678-90ab-4cde-8f12-3456789abcde
 credentialsFile:
-  secretRef: hq-estate/CLOUDFLARE_TUNNEL_CREDENTIALS_MY_PROJECT
+  secretRef: vault/CLOUDFLARE_TUNNEL_CREDENTIALS_MY_PROJECT
 ingress:
   - hostname: my-app.example.com
     service: http://web:8080
@@ -117,6 +121,49 @@ Every ingress service URL must bind to an internal address (a compose
 service name or a loopback interface); binding to `0.0.0.0` or a
 non-loopback numeric IP refuses at apply time.
 
+## Zone resolution
+
+The applying project stores the target Cloudflare zone id as a secret
+reference rather than as a plaintext value in the tracked tree. TAC-4004
+owns the zone-resolution seam: at apply the resolver reads the elicited
+`cloudflare-zone-secret` through the `security-secrets-management`
+companion, and the resulting applied sidecar records only the
+`secretRef`. A grep across the applying tree for the resolved zone id
+must find zero matches on the tracked file set. Failure paths, per
+REQ-006:
+
+- If the elicited `cloudflare-zone-secret` does not resolve via the
+  vault seam (the reference is missing, or the seam returns an error),
+  apply refuses with `apply.zone-unresolved` naming the elicit id and
+  writes no sidecar (US-39109 AC-tunnel-zoneUnresolved).
+- If the Cloudflare API returns 401 or 403 on the tunnel-route call for
+  the resolved zone id, apply refuses with `apply.zone-unauthorised`
+  naming the resolved zone id metadata (never the token) and writes no
+  sidecar (US-39109 AC-tunnel-zoneUnauthorised).
+
+## Public-hostname template expansion
+
+TAC-4004 owns the public-hostname template. The default template is
+`<service>.<zone>` and each ingress rule's public hostname is rendered
+by substituting the `service` placeholder with the ingress rule's
+service name and the `zone` placeholder with the resolved zone. Every
+rendered hostname must match the DNS-label regex
+`^[a-z0-9-]+(\.[a-z0-9-]+)+$`. Failure paths, per REQ-007:
+
+- If the template names an undefined placeholder (for example
+  `<unknown>`), carries an unclosed brace (for example
+  `<service.<zone>`), or renders a value that violates DNS-label rules
+  (labels longer than 63 characters, or characters outside `[a-z0-9-]`),
+  apply refuses with `apply.hostname-template-malformed` naming the
+  offending template and writes no sidecar (US-39110
+  AC-tunnel-hostnameTemplateMalformed).
+- If two distinct service names expand under the elicited template to
+  the same concrete hostname (for example a template with the
+  `<service>` placeholder omitted or replaced by a constant), apply
+  refuses with `apply.hostname-template-duplicate` naming the collided
+  hostname and both offending rule indices; no sidecar is written
+  (US-39110 AC-tunnel-hostnameTemplateDuplicate).
+
 ## Credentials rotation pattern
 
 The tunnel credentials JSON file lands on the host at mode 0o400 (owner
@@ -150,7 +197,7 @@ Provides: `tunnelBridge` capability; new global topic
 The `deliver-ci-workflows` shelf blueprint invokes the two account-bound
 probes on a scratch subdomain when the account tokens are present;
 without them the probes record `accountBoundSkipped: true` and the
-aggregate flips to pass per hetzner-round-7-spec section 3.5.
+aggregate flips to pass when both env vars are absent.
 
 ## Running the probes
 
@@ -180,7 +227,7 @@ Mutations (fixture-side, one per switch; the probe modules never read
 
 Real-account probes need `CI_HAS_CLOUDFLARE_ACCOUNT=true` and
 `CI_HAS_HETZNER_ACCOUNT=true` (plus `CI_HAS_CLOUDFLARE_ACCESS=true` for
-the gated sub-case per the round-7 Q4 ratification):
+the gated sub-case):
 
 ```
 CI_HAS_CLOUDFLARE_ACCOUNT=true CI_HAS_HETZNER_ACCOUNT=true \

package/blueprints/edge-cloudflare-turnstile/CHANGELOG.md

@@ -1,6 +1,37 @@
 # Changelog
 
+## 1.1.3 - 2026-09-10
+
+Positive-evidence rule alignment on the probe pack skip path (authoring standard section 7d).
+
+- Fixture: added a "Declared env vars" section to the fixture README (`packages/rcf-lite/test/fixtures/probe-pack-edge-cloudflare-turnstile/README.md`) declaring every env var the fixture and its probes read, per authoring standard section 7d. Probe pack itself unchanged (no account-bound branch).
+
+
+## 1.1.2 - 2026-09-10
+
+Capability token named in the requirements layer; single-mechanism story legality notes; magic-link guard probe extended with a mint-count delta assertion.
+
+- Extended REQ-001 description to name the declared `humanCheck` capability token verbatim with a one-line runtime clause tying the token to the client widget mount that delivers it.
+- Added AC-35101-3 on US-35101 as a fixed AC that binds the manifest-declared `humanCheck` token to the widget-render mechanism the fixture surfaces.
+- Appended the section 7a legality note to AC-35106-1, AC-35107-1 and AC-35108-1 recording that each single-AC story's mechanism has no additional documented failure path in the guide or the anchored TAC.
+- Extended the magic-link-guard probe check (`AC-turnstile-magicLinkGuard` in `probe-packs/edge-cloudflare-turnstile.pack.mjs`) to read a pre-mint and post-mint mint-outcome count from the fixture's `/api/events` sink and return `pass` only when both refusals are observed AND the mint-outcome delta is exactly zero; the observed delta is included in the positive-evidence detail.
+
+## 1.1.1 (register-sweep patch, 2026-09-10)
+
+- Register: neutral wording in shipped prose (no capability change).
+
+## 1.1.0 - 2026-09-09
+
+Adds REQ-layer backing and extends the AC set to cover every documented failure path.
+- Normalised the `cf-turnstile-response` token casing across the shipped guide, README, REQs, TACs and user stories to the lowercase form-field literal Cloudflare's client-side rendering and server-side validation docs specify verbatim (closes specimen F-1 in the vendor-fact direction under 7b; earlier interim pass mistakenly took the pre-existing TAC-3601 title-case as canonical). TAC-3601 owns the literal with a `vendorCitation` and US-35101 AC-35101-1 is re-marked `fixed` with the same citation. The consistency-lint AC-3 spec test continues to assert the specimen is closed on the shipped blueprint.
+- Added failure-path ACs to US-35102 (AC-35102-2..4 close F-3: missing sitekey, missing secret, only-one-of-pair boot refusal) and US-35103 (AC-35103-2..6 close F-2: siteverify timeout, network failure, non-2xx upstream, invalid JSON, missing success-field fail-closed).
+- Every REQ now carries `deliveredBy`; every AC carries `disposition` (`AC-35102-1` and `AC-35103-1` marked `fixed` with vendor citations to the Cloudflare Turnstile testing docs); ACs referencing owner-owned literals carry `ownerRef`.
+- Chain-consistency lint reports 0 findings on both passes.
+
+
 All notable changes to `edge-cloudflare-turnstile` are recorded here. The shape follows Keep a Changelog and Semantic Versioning per the blueprint authoring standard.
+- Flipped `cf-turnstile-response` to the lowercase vendor literal per Cloudflare's client-side rendering and server-side validation docs across guide, README, CHANGELOG, REQ-001, REQ-003, TAC-3601, TAC-3602, US-35101, US-35104 and US-35105; TAC-3601 responsibility 3 owns the literal and US-35101 AC-35101-1 is marked `fixed` with `vendorCitation` at the client-side-rendering page. Added `AC-35101-2` for the always-fail test-sitekey mount branch (`fixed`, `vendorCitation` at the Cloudflare testing docs). Split US-35104 into canonical-shape (guard-shape-scan) and missing-token-runtime (400 turnstile.token-missing) ACs each with a concrete oracle and an `ownerRef` into TAC-3602. Vendor citations added on US-35101 AC-35101-1/2, US-35102 AC-35102-1, US-35103 AC-35103-1, US-35104 AC-35104-2, US-35105 AC-35105-2 and US-35106 AC-35106-1. Every AC in this blueprint is `fixed` (refusal codes, event-secrecy record shapes, probe verdicts and vendor test-key observables are all mechanism-invariant). Genuinely single-mechanism stories (US-35106, US-35107, US-35108) carry the section-7a note inside the story `description` field, not in a schema-illegal new field.
+
 
 ## 1.0.0 (2026-09-07)
 
@@ -13,7 +44,7 @@ All notable changes to `edge-cloudflare-turnstile` are recorded here. The shape
 - 4 elicited parameters on `blueprint.json`: `turnstile-sitekey`, `turnstile-secret` (routed through `security-secrets-management` when applied), `turnstile-widget-mode` (enum default `managed`), `turnstile-guarded-surfaces`.
 - `suggestedCompanions`: `logging` (for the metadata-only event sink retention), `errorHandling` (for the verifier failure boundary), `secretsManagement` (for the paired sitekey and secret).
 - Ships the dedicated pack fixture at `packages/rcf-lite/test/fixtures/probe-pack-edge-cloudflare-turnstile/` per spec section 3.3. The fixture pins the Cloudflare public test keys documented at `https://developers.cloudflare.com/turnstile/troubleshooting/testing/` as environment defaults so the pack runs without real Turnstile credentials.
-- Anatomy test at `packages/rcf-lite/test/blueprint/edge-cloudflare-turnstile-anatomy.test.js` covers TS-120..127 on the T-5 repo-chain slice.
+- Anatomy test at `packages/rcf-lite/test/blueprint/edge-cloudflare-turnstile-anatomy.test.js` covers TS-120..127 on the repo-chain slice.
 
 ### Known limitations
 

package/blueprints/edge-cloudflare-turnstile/README.md

@@ -20,9 +20,9 @@ Cloudflare Turnstile as a CAPTCHA-alternative on public-facing forms. Ships the
 
 ## Contract at a glance
 
-- **Client widget mount** (TAC-3601) injects Cloudflare Turnstile JS from `https://challenges.cloudflare.com` and no other origin; renders the widget for the elicited sitekey; populates the hidden `Cf-Turnstile-Response` token field on submit.
+- **Client widget mount** (TAC-3601) injects Cloudflare Turnstile JS from `https://challenges.cloudflare.com` and no other origin; renders the widget for the elicited sitekey; populates the hidden `cf-turnstile-response` token field on submit.
 - **Server-side siteverify verifier** (TAC-3602) POSTs `{secret, response}` to `https://challenges.cloudflare.com/turnstile/v0/siteverify`. On `success:true` the handler proceeds. On `success:false` the handler rejects with 400 and the refusal body carries the documented `error-codes` value; the sitekey is never in the refusal body.
-- **Refuse-if-token-missing guard** (TAC-3602) is the sole reader of the `Cf-Turnstile-Response` payload field; a submit without a token rejects with `400 {"errorCode":"turnstile.token-missing"}` before any downstream handler runs.
+- **Refuse-if-token-missing guard** (TAC-3602) is the sole reader of the `cf-turnstile-response` payload field; a submit without a token rejects with `400 {"errorCode":"turnstile.token-missing"}` before any downstream handler runs.
 - **Composition with security-auth-magic-link** (TAC-3603) registers the magic-link mint route under the Turnstile guard so a mint submit reads through the same token check.
 - **Widget mode** (ADR-3602) is an elicited enum: `managed`, `non-interactive`, `invisible`. Default: `managed`.
 

package/blueprints/edge-cloudflare-turnstile/blueprint.json

@@ -1,6 +1,6 @@
 {
   "slug": "edge-cloudflare-turnstile",
-  "version": "1.0.0",
+  "version": "1.1.3",
   "category": "edge",
   "capabilities": [
     "humanCheck"

package/blueprints/edge-cloudflare-turnstile/contributions/requirements/edge-cloudflare-turnstile-req-001.json

@@ -2,7 +2,7 @@
   "reqId": "edge-cloudflare-turnstile-REQ-001",
   "prdId": "PRD-001",
   "title": "Client widget mount: an elicited sitekey renders the Turnstile widget and the mount injects no third-party script beyond Cloudflare Turnstile JS host",
-  "description": "The applying project reaches Cloudflare Turnstile through a client widget mount that renders on elicited surfaces using the elicited TURNSTILE_SITEKEY. The mount injects only Cloudflare Turnstile JS from the Cloudflare Turnstile host (https://challenges.cloudflare.com/turnstile/v0/api.js per https://developers.cloudflare.com/turnstile/) and no other third-party script. On submit the widget populates a hidden Cf-Turnstile-Response token field the form payload carries.",
+  "description": "The applying project reaches Cloudflare Turnstile through a client widget mount that renders on elicited surfaces using the elicited TURNSTILE_SITEKEY. The mount injects only Cloudflare Turnstile JS from the Cloudflare Turnstile host (https://challenges.cloudflare.com/turnstile/v0/api.js per https://developers.cloudflare.com/turnstile/) and no other third-party script. On submit the widget populates a hidden cf-turnstile-response token field the form payload carries. Delivers the declared `humanCheck` capability token: the client widget mount is the runtime surface the token names, so once the applying project renders the widget on an elicited surface the `humanCheck` promise binds every submit the surface accepts.",
   "category": "functional",
   "domain": "edge",
   "priority": "must",
@@ -13,5 +13,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-07T20:00:00.000Z",
-  "updatedAt": "2026-09-07T20:00:00.000Z"
+  "updatedAt": "2026-09-10T00:00:00.000Z",
+  "deliveredBy": {
+    "tacId": "TAC-3601-edge-cloudflare-turnstile-widget-mount",
+    "field": "interfaces.mountTurnstile"
+  }
 }

package/blueprints/edge-cloudflare-turnstile/contributions/requirements/edge-cloudflare-turnstile-req-002.json

@@ -13,5 +13,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-07T20:00:00.000Z",
-  "updatedAt": "2026-09-07T20:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00.000Z",
+  "deliveredBy": {
+    "tacId": "TAC-3602-edge-cloudflare-turnstile-server-verifier",
+    "field": "interfaces.createTurnstileVerifier"
+  }
 }

package/blueprints/edge-cloudflare-turnstile/contributions/requirements/edge-cloudflare-turnstile-req-003.json

@@ -2,7 +2,7 @@
   "reqId": "edge-cloudflare-turnstile-REQ-003",
   "prdId": "PRD-001",
   "title": "Refuse-if-token-missing guard on elicited surfaces: a submit without a token is rejected with 400 before any downstream logic",
-  "description": "The applying project registers a token-required guard at every elicited surface. A submit whose payload lacks the Cf-Turnstile-Response field is rejected with 400 before any downstream handler runs. The refusal body carries a stable error-code (turnstile.token-missing), not the sitekey.",
+  "description": "The applying project registers a token-required guard at every elicited surface. A submit whose payload lacks the cf-turnstile-response field is rejected with 400 before any downstream handler runs. The refusal body carries a stable error-code (turnstile.token-missing), not the sitekey.",
   "category": "functional",
   "domain": "edge",
   "priority": "must",
@@ -13,5 +13,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-07T20:00:00.000Z",
-  "updatedAt": "2026-09-07T20:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00.000Z",
+  "deliveredBy": {
+    "tacId": "TAC-3602-edge-cloudflare-turnstile-server-verifier",
+    "field": "interfaces.verifier.guard"
+  }
 }

package/blueprints/edge-cloudflare-turnstile/contributions/requirements/edge-cloudflare-turnstile-req-004.json

@@ -13,5 +13,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-07T20:00:00.000Z",
-  "updatedAt": "2026-09-07T20:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00.000Z",
+  "deliveredBy": {
+    "tacId": "TAC-3603-edge-cloudflare-turnstile-magic-link-hook",
+    "field": "responsibilities.guardMint"
+  }
 }

package/blueprints/edge-cloudflare-turnstile/contributions/requirements/edge-cloudflare-turnstile-req-005.json

@@ -13,5 +13,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-07T20:00:00.000Z",
-  "updatedAt": "2026-09-07T20:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00.000Z",
+  "deliveredBy": {
+    "adrId": "ADR-3602-edge-cloudflare-turnstile-widget-mode",
+    "field": "decision.widgetModeEnum"
+  }
 }